Subject: [Mip6] RE: concerns about draft-devarapalli-mip6-ikev1-bootstrap-00.txt

From: [email-masked]
Date: Wed, 26 Oct 2005 13:52:30 -0700

Francis,

>
>I maintain my previous concerns about MODECFG and XAUTH. Now 
>I've read the whole document and I have some other concerns:
> - there are some normative references to documents which timed out
>   many years ago
> - there should be security considerations about the well known
>   essential insecurity of XAUTH (*)

It uses Hybrid authentication which essentially supports
asymmetric authentication for the entities. Hybrid
uses XAUTH but differently. See draft-kelly-ipsra-userauth-00.txt
on why Hybrid does not have the same secrity issues as XAUTH.
The reason we put this there is to support cases like where
the MN just has a MN-AAA shared secret.
 
> - I am not convinced DHCPv6 can be used over IKE as described:
>   DHCPv6 is designed to run between the client and the first 
>relay/server
>   over a link using multicast and link-local addresses. So it 
>runs without
>   problem over L2TP/PPP between a client and a NAS. Here we 
>have a tunnel
>   mode IPsec which is pretty different than a real tunnel interface.

RFC 3775 assumes that IPsec is modeled as an interface.
This one shows 
http://www.research.earthlink.net/ipv6/ipv6-ipsec-tunnels.pdf
how DHCPv6 can be secured using IPsec. So, i don't understand
your concern.

-mohan

>So sections 3.1, 3.2 (HoA config) and 4 (SA setup) are at 
>least questionable.
>The remaining spec is the section 5 (DNS update) which is 
>already in a bootstrapping document... So I am sorry but IMHO 
>there is nothing really useful today in the document

>Regards
>
>[email-masked]
>
>(*): If someone knows Jose Puthenkulam, ask him to refresh its I-D.
>

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Thu, 27 Oct 2005 00:19:00 +0200

In your previous mail you wrote:

=> expired I-D again (and last century).

=> IPsec tunnel mode SAs are not real interfaces, they have no
link-local addresses for instance, when DHCPv6 requires a *link*.

   This one shows 
   http://www.research.earthlink.net/ipv6/ipv6-ipsec-tunnels.pdf
   how DHCPv6 can be secured using IPsec.

=> using real interfaces, *not* IPsec tunnel mode. BTW it talks
about AH on FreeBSD which is well known to not support AH tunnel mode.

   So, i don't understand your concern.
   
=> you try to run DHCPv6 over an IPsec tunnel mode something which
is not a link at all and doesn't provide what DHCPv6 needs
(link-local addresses, multicast, etc) for the client-relay/server.

BTW there is a solution to your problem, it is to colocate a
relay on the MN and to use the IPsec tunnel mode between the relay
and the DHCPv6 entity (relay or server) on the HA.
(the idea comes from a remark of KAME team: to colocate DHCPv6 entities
on the same box is a mess because of port conflicts, I needed the
relay/server case but the client/relay case only was supported).
   
Regards