Subject: RE: FQDN authorization and splitting drafts (was Re: [Mip6] ConcensusCall: DNS Update for Bootstrapping)

From: Gerardo Giaretta <[email-masked]>
Date: Mon, 12 Dec 2005 19:31:49 +0100

> Vidya Narayanan wrote:
> >>>This is misleading. You are not solving the above problem 
> of generally
> >>>protecting against all malicious nodes. You are 
> specifically solving
> >>>the problem of "a node being trusted to provide the right FQDN
> >>>providing the wrong HoA". The definition of a malicious 
> node is really
> >>>much broader and can be subject to interpretation.
> >>
> >>sure. but we should solve specific problems instead of
> >>taking on everything you want.
> >>
> > 
> > 
> > Fine. But you should state the specific problem you are solving and
> > the problems that exist, but are considered outside the scope of the
> > document. Assuming that a certain problem is more important than a
> > certain other problem doesn't make sense to me.
> 
> the specific issues we are solving are clearly
> mentioned in the document.
> 
> - redirection attacks by sending DNS updates for some
> other mobile node's HoA.
> - scalability. an operator having to setup security
> between each mobile node and the DNS server.
> 
> let us know how we can improve the text if this is not
> clear.
> 

I agree. Vidya: please send us the paragraph or the sections that you
think need to be improved to solve your issues. It seems that this issue
can be solved by some additional and clarifying text somewhere in the
draft.

--Gerardo

> Vijay
> 
> 
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vidya Narayanan <[email-masked]>
Date: Thu, 15 Dec 2005 21:43:11 +0530

Hi Folks,
Sorry for the delayed response on this. How about adding this
paragraph in the document (perhaps add a sentence in reference to this
in section 6 and add the paragraph in section 9.5)?

"The assumption behind having the home agent perform the DNS update on
behalf of the mobile node is that the home agent is a more trusted
entity than the mobile node. It should be noted that the approach does
not provide FQDN ownership authorization, even though it allows home
address authorization. DNSSEC provides a means of performing FQDN
ownership authorization. Currently, an implementation must choose
between the approach in this document and the use of DNSSEC – hence, a
means of providing both FQDN and address authorization is currently
not feasible."

Thanks,
Vidya

---

From: Francis Dupont <[email-masked]>
Date: Thu, 15 Dec 2005 18:05:38 +0100

In your previous mail you wrote:

   Content-Transfer-Encoding: base64

=> again your message in encoded (perhaps because there is a Windows
character in it between DNSSEC and hence).

To come back to the idea, the DNS recommends an authorization on NAMEs
(cf RFC 1035 3.2.1) which are FQDNs for AAAA RRs and reversed IP addresses
for PTR RRs when the document tries to get an authorization on RDATAs.

DNSSEC (between the MN and the DNS server) authorized FQDNs when
the HoA allocation entity (named HA after) should get authorization on HoA.

So in the standard setting, the MN updates its AAAA and the HA the PTR,
this gives right properties for NAMEs but leave the MN a possibility
to register a fake address and to give a fake FQDN to the HA, so
there is no check at all for RDATAs: the DNS but only the DNS is happy.

The idea (according to my interpretation of the document which does
things exactly in the wrong way :-) is to ask the MN to give its FQDN
to IKE so IKE can check it during its authentication phase and get the
right security properties for both the FQDN and the HoA, hence it can
update the AAAA and the PTR RRs with checked NAMEs and RDATAs.

This does not really rely on IKE, it can work when the entity which
controls HoA allocation, the entity which performs the MN authentication
and the entity which gets the FQDN from the MN work together or,
simpler, are the same (which is the case for IKE in the recommended
profile).

Regards

[email-masked]

---

From: "James Kempf" <[email-masked]>
Date: Thu, 15 Dec 2005 10:09:38 -0800

Looks Ok to me.

Basically, the DNS option is a SHOULD anyway, not a MUST. If the host does 
the update itself, it doesn't need to send the option, and the HA won't do 
anything. I think we ought to state this as well.

            jak

----- Original Message ----- 
From: "Vidya Narayanan" <[email-masked]>
To: "Gerardo Giaretta" <[email-masked]>
Cc: <[email-masked]>; "Vijay Devarapalli" <[email-masked]>
Sent: Thursday, December 15, 2005 8:13 AM
Subject: Re: FQDN authorization and splitting drafts (was Re: 
[Mip6]ConcensusCall: DNS Update for Bootstrapping)

>> Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia 

--------------------------------------------------------------------------------

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 15 Dec 2005 11:18:12 -0800

James Kempf wrote:
> Looks Ok to me.
> 
> Basically, the DNS option is a SHOULD anyway, not a MUST. If the host 
> does the update itself, it doesn't need to send the option, and the HA 
> won't do anything. I think we ought to state this as well.

it is not even a SHOULD currently. the draft currently
uses 'MAY'. if the node has any other mechanism by which
it can update its DNS entry it can use that mechanism.
if it doesnt, it asks the HA to update the DNS entry.

Vijay

> 
>            jak
> 
> ----- Original Message ----- From: "Vidya Narayanan" 
> <[email-masked]>
>> between the approach in this document and the use of DNSSEC  hence, a

---

From: Francis Dupont <[email-masked]>
Date: Fri, 16 Dec 2005 00:28:07 +0100

=> this seems to be more an argument for a MAY.

---

From: "James Kempf" <[email-masked]>
Date: Fri, 16 Dec 2005 08:30:17 -0800

MAY is fine.

            jak

----- Original Message ----- 
From: "Francis Dupont" <[email-masked]>
To: "James Kempf" <[email-masked]>
Cc: "Vidya Narayanan" <[email-masked]>; "Gerardo Giaretta" 
<[email-masked]>; <[email-masked]>; "Vijay Devarapalli" 
<[email-masked]>
Sent: Thursday, December 15, 2005 3:28 PM
Subject: Re: FQDN authorization and splitting drafts (was Re: 
[Mip6]ConcensusCall: DNS Update for Bootstrapping)

> does