Subject: RE: [mobile-ip] Re: Comments on Regional Registration

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Fri, 16 Mar 2001 01:15:42 +0100

> It seems that in the HMIPv6 draft, you suggest to distribute the session
> keys either using IKE or AAA servers and to authenticate the BUs. The same
> solution can apply to Regional Registration: we suggest to use AAA servers,
> so I don't think that it is more complex.
> 
	=> Please read your statement above carefully. You just said HMIPv6
	works with either IKE or AAA, but regional only works with AAA.
	I think that's a significant difference. 
	BTW the HMIPv6 draft only talks about AAA in terms of context
	transfer, not for SA establishment. We presented another 
	draft for that purpose and we certainly do NOT want to restrict
	the use of HMIPv6 to the AAA SA generation scenario.

> The only difference when using anycast address is in anti replay attacks: We
> suggest to use nonces instead of the sequence number defined in AH.
> 
	=> Can you use IKE for a key exchange with an anycast address ???

	Thanks,
	Hesham

> -----Original Message-----
> From: ext Hesham Soliman (ERA) [mailto:[email-masked]]
> Sent: 15 March, 2001 10:10 AM
> To: [email-masked]'
> Subject: RE: [mobile-ip] Re: Comments on Regional Registration
> 
> 
> > >	=> I'm not at all trying to discredit anycastl. I'm just 
> > >	wondering how you could use it in light of the current
> > >	standards. You still didn't tell me what the solution 
> > >	is. 
> > >	Proposing a solution for setting up an SA with an
> > >	anycast group would be a great proposal, but 
> > >	I don't think we need several standards to solve
> > >	this particular problem. We already have a solution
> > >	and I'm starting to question the need for alternatives
> > >	if nothing is raised against HMIPv6. Especally if 
> > >	the alternative is a lot less robust and overrides 
> > >	the use of standard routing between the anchor point
> > >	and the MN.
> > >
> > 
> > actually that there are different proposals on the way to set up Security
> > Associations and to authenticate the BU using AH in Appendix B of the
> draft.
> > 
> 	=> Yes I saw that, but this is hardly a standard or an accepted 
> 	method, I don't think we can base it on the appendix surely. 
> 	Even if we can, my main point is why are we adding all this 
> 	complication to achieve the same effect that HMIPv6 does ?
> 	I haven't heard an answer till now.
> 
> 	Hesham

---

From: Michael Thomas <[email-masked]>
Date: Thu, 15 Mar 2001 16:35:14 -0800 (PST)

I think that Hesham brings up a really good point
here.  Where it is feasible, *all* of these
scenarios should allow whatever key distribution
protocol -- IKE, Kerberos, etc -- is right for the
deployment. Explicitly joining MIP and AAA at the
hip -- which seems to be the overall direction of
this WG -- makes me *seriously* queasy. If there
were an area where people should be scared about
declaring a single -- or even prefered -- method,
key distribution would probably be one of them.

Also: the general expectation of a AAA
infrastructure seems highly suspect to me. There
is no *requirement* in IP for AAA. It -- like just
about every other IETF protocol -- is and should
remain severeable from the base MIP protocol. If
keying with AAA is allowed, at the very least the
door MUST be open in all cases for other key
distribution schemes including sneakernet.

		 Mike

---

From: "Jari T. Malinen" <[email-masked]>
Date: Thu, 15 Mar 2001 19:45:45 -0800

Hello,

> > > >   the use of standard routing between the anchor point

I believe we are not overriding standard routing in the base draft.
Regional forwarding is only optional, you can also use regular
tunneling or host-based routing (if on-link). Using more than one
layer has the same principle of binding-driven forwarding that is
the case with MAP usually with one layer, or sometimes with more
than one layer (extended mode, mobile routers).

HMIP does not do everything possible to preserve last hop bandiwdth
usage efficiency and scalability.

> >       I haven't heard an answer till now.

There is more text because alternative modes are provided. In fact,
there can be a mode where IKE is used, you do not then use anycast.
However, as heard from some authoritative parties, PKI is not
ubiqutous anytime soon and simply using IPSec is not going to solve
the authorization problem. Considering AAA is therefore needed and
doing it in a more verbose way than HMIP is not necessarily
regreg6-specific complexity. Remember the AAAL functionality tends
to be at the edge, HMIP also has some "complication" when this
is specified in detail.

Still about the motivation you repeatedly tell us is missing:
Having localized mobility is supposed to be optimization in the
first place. Why not then try to do it to the fullest, solve the
basic problem of reducing signaling load (there I agree one level is
enough to have the fixed CoA), _and_ localizing the location update
to the maximum. There we can use multiple levels to bring responder
closer to the mobile node than where the fixed address resides. If
we have mobile routers, what if they use costly links when forming
the hierarchy, is it not feasible to consider that we could have
localized signaling below that?

> >       Hesham

Best Regards,

-Jari