Subject: RE: [Mip6] Concensus Call: DNS Update for Bootstrapping

From: Gerardo Giaretta <[email-masked]>
Date: Tue, 06 Dec 2005 10:25:47 +0100

Hi Vidya, 

> I'm just catching up with all the emails here - and, I am not even
> sure where to start :) So, instead of replying to each of the mails,
> I'm going to try to summarize my thoughts in this one email.
> 
> I think there is a misunderstanding of what I am saying - I am
> not really *in* the debate of whether this work should be done in mip6
> or dns or dhc. I do, however, think that it can be left out of the
> bootstrapping draft. The main reason I'm saying this is the draft
> currently (at least in my mind) doesn't seem to be clear on this
> subject and I am not convinced that it is solving the security issues
> correctly. It seems

well, we can try to solve the reamining technical or security issues, if
any. The only issue raised so far seems to be that the DNS update is not
in the scope of the bootstrapping draft. I disagree since it is part of
IP reachability.

> bizzarre to say that FQDN ownership is not an issue, but address
> ownership alone is - I say this without getting into the discussion of
> whether it is 2136 or this draft that has an issue.
> 
> The issue really is not much different from a host obtaining an IP
> address via DHCP doing a DDNS update. Even though this is 
> debatable, I'll agree
> that a DDNS update for the HoA is likely to be important for 
> IP reachability. It
> would be better left for a separate draft. Perhaps, a separate draft
> on performing DNS updates for a mobile node can be done in
> collaboration with the DNS community and can clearly provide a
> view of what it is solving and securing and what it isn't.
> 
> The topic of auth option protocol keeps coming up - this draft does
> not provide bootstrapping solutions for the auth option protocol. That
> work is yet to be done. In fact, I thought it wasn't even in the scope
> of the design team to do that work. If we are talking about the auth

The auth protocol was not in the scope of the DT. The DT did not work on
it and now the DT has been disbanded. 

> protocol, I think there is a lot more to discuss here than just DNS.
> 

yes, but the solution defined in split draft for DNS update can be
re-used both for IKEv1 and auth protocol bootstrapping.

--Gerardo

> However, using the same argument, I believe that the DNS part of the
> solution can be the same for both IKEv2 based bootstrapping and the
> auth option bootstrapping - from both points of view, it seems better
> to separate it out from individual bootstrapping solution drafts.
> 
> Does this make sense to anyone?
> 
> Thanks,
> Vidya
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mip6
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vidya Narayanan <[email-masked]>
Date: Tue, 6 Dec 2005 09:56:09 -0600

> re-used both for IKEv1 and auth protocol bootstrapping.

So, does this mean that every bootstrapping solutions draft is going
to describe the same DNS solution? Why doesn't it make sense to keep
this in a separate document?

Vidya