Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

From: "COMBES Jean-Michel RD-MAPS-ISS" <[email-masked]>
Date: Mon, 24 Oct 2005 19:23:51 +0200

> -----Original Message-----
> From: Gerardo Giaretta [mailto:[email-masked]] 
> Sent: Monday, October 24, 2005 7:11 PM
> To: COMBES Jean-Michel RD-MAPS-ISS
> Cc: [email-masked]; Kilian Weniger; James Kempf; Narayanan 
> Vidya-CVN065; Francis Dupont; Petrescu Alexandru-AAP021
> Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt
> 
> Hi Jean-Michel, 
> 
> > Hi,
> > 
> > IMO, we MUST have a solution permitting: 
> > o the MSP to assign only the HA he wants to allocate AND o 
> the MN to 
> > pick a HA in from a HA list if the MSP allows such a thing
> > 
> 
> I think this is possible using DNS-based scheme defined in
> draft-ietf-mip6-bootstrapping-split-01.

How?

> If in your opinion exposing HA addresses in DNS is an issue, in
> integrated scenario a DHCP-based solution may be used (see the
> integarted scenario draft). 
> 
> > For the moment, with these proposals, the MSP has not the 
> > possibility to
> > manage its HA as he wants ...
> > 
> 
> Why in DNS-based solution you think this is not possible? 

This is the MN that will choose the HA from the listed HA in the DNS.

> 
> > Regarding the two present solutions:
> > o DNS-based DHAAD
> > I don't like this solution because such mechanism gives the 
> location,
> > for a MSP, of all its HA, which are the MIPv6 point of 
> failure and so
> > the prioritized targets for "bad guys". You give the stick to 
> > be beaten
> > ... :(
> 
> Sorry are you referring to DNS-based HA discovery defined in
> draft-ietf-mip6-bootstrapping-split-01

Yes.

>  or something else? I'm getting
> confused with the acronym DHAAD since it is usually used to refer the
> solution defined in rfc3775.

Sorry :)

JMC.

> 
> --Gerardo
> 
> > o ICMP-based mechanism
> > Here again, the present mechanism gives all the HA but I 
> > think it may be
> > simply modified to give only one HA if the MSP wants to assign HA.
> > The main issue is regarding its security ... Maybe 
> > Alexandru's proposal
> > or HAHA proposal would be interesting.
> > 
> > Best regards.
> > 
> > JMC.
> > 
> > France Telecom - R&D Division - MAPS/NSS   
> > Jean-Michel COMBES, Internet/Intranet Security
> > E-Mail: [email-masked]
> > Phone: +33 (0)1 45 29 45 94
> > Fax: +33 (0)1 45 29 65 19
> > Mobile: +33 (0)6 07 29 30 16 
> >  
> > 
> > > -----Original Message-----
> > > From: [email-masked] [mailto:[email-masked]] On 
> > > Behalf Of Narayanan Vidya-CVN065
> > > Sent: Monday, October 24, 2005 5:21 PM
> > > To: Francis Dupont; Petrescu Alexandru-AAP021
> > > Cc: [email-masked]; Kilian Weniger; James Kempf
> > > Subject: RE: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt 
> > > 
> > > >    
> > > > => the two questions are:
> > > >  - should we keep a DHAAD mechanism or HA assignment is 
> the right 
> > > > thing
> > > >    to do?
> > > >  - is the DNS-based DHAAD mechanism better enough to 
> replace the 
> > > > ICMP-base
> > > >    one?
> > > > 
> > > 
> > > These are good questions. I believe that a DNS-based 
> > > mechanism is largely better than an ICMP-based mechansim. For 
> > > those who wish to secure the operation, at least an option is 
> > > available. Whether DNSSEC will be widely deployed is a 
> > > separate question, but at least, it is an option. Also, it 
> > > moves away from having to configure the home network prefix 
> > > and removes the limitation of dynamic HA assignment within 
> > > the same subnet, both of which are big pluses in my mind. 
> > > 
> > > Regards,
> > > Vidya
> > > 
> > > _______________________________________________
> > > Mip6 mailing list
> > > [email-masked]
> > > https://www1.ietf.org/mailman/listinfo/mip6
> > > 
> > 
> > _______________________________________________
> > Mip6 mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/mip6
> > 
> 
> 
> Gruppo Telecom Italia - Direzione e coordinamento di Telecom 
> Italia S.p.A.
> 
> ====================================================================
> CONFIDENTIALITY NOTICE
> This message and its attachments are addressed solely to the persons
> above and may contain confidential information. If you have received
> the message in error, be informed that any use of the content hereof
> is prohibited. Please return it immediately to the sender and delete
> the message. Should you have any questions, please send an e_mail to 
> [email-masked]. Thank you
> ====================================================================
> 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6