Subject: [MOBILE-IP] KENA draft

From: Mohamed Khalil <[email-masked]>
Date: Mon, 25 Oct 1999 15:04:59 -0500

We would like to announce the availibility of our KENA draft from the
following ftp site:-
 ftp://137.118.21.16/mobile-ip/docs

What is KENA?
----------------------
     As deployment of global IP networks become more widespread, there
     are several challenges that become apparent, one of the more
     important ones being secure access from a users perspective. Based
     on the users service requirements, secure access will have to be
     setup between a multitude of nodes in a distributed fashion. The
     nature of these security requirements may well be real-time and
     dynamic in nature and MUST protect the confidentiality of the user.
     These requirements are clearly manifested in the mobility domain.
     This draft outlines a general purpose Key Exchange framework for
     Network Architectures [KENA] with centralised key generation and
     management tailored for distributed nodes. The draft also describes
     a specific implementation of KENA in the IP mobility domain by
     extending Mobile IP

KENA versus SAFe-MIP - a comparison:-
------------------------------------------------------------

Common Concepts:

a- We believe that using IKE and IPSEC has the following disadvantages:
section 4.1
    1- Will introduce extra messages for authentication in addition to the
Mobile-IP messages will result in a poor MN's handoffs.
    2- It is not fessible to expect that each MN, FA, and HA in the world
will use IKE and IPSec.
b- Sending the credential  of FA in  conjunction with the Registration
Request. This information will be used in both Kena and SAFE-MIP to
authenticate the Foreign domain by the Home Domain (HAAA. section 4.3  (MN
Registration Request Generation).
c- Both assume that the FAAA-FA link and HAAA-HA links are secured section
4.3 (Registration Request Processing by FA).
d- We try to do everything in a message-round trip which is compatible with
Mobile-IP. section 4.1 last parg.
Differences:

Differential Concepts:-

a- Sending User-NAI in the clear violates the concept of user privacy.
section 4.3 of SAFe MIP (MN Registration Request Generation)
b- Making the validation of FAAA and HAAA as part from the Registration
Request is unnecessary because this will cause extra information to be
exchanged between the FAAA and HAAA (Foreign Public Key Authentication
extension,section 4.4.3.3 and Home Public Key authentication extension
section 4.4.3.4 of SAFe MIP). Since, FAAA and HAAA are static entities so
IKE and IPSec is better for authentication than the method is mentioned in
the draft.
c- The problem of shared key between FA-MN, FA-HA, and MN-HA is solved by
KENA and is not a problem any more as mentioned in 4.1.

M Khalil

Nortel Networks