Subject: RE: [mobile-ip] MIPv6 security issues: how to move forward

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 27 Mar 2001 17:18:34 +0200

Mike, 

> Paul Francis writes:
>  > What I'm suggesting instead is putting the HA close to the MN, so that going
>  > through it is not very costly (by getting an HA in the visited domain).  My
>  > form of route optimization will occasionally end up with a long path, if for
>  > instance a mobile goes very far while maintaining a connection.  I'm saying
>  > that this form of route optimization is worth it if it means we can delay
>  > the hard problem of security.
> 
>    I think you've falled into a pretty easy trap.
>    The main (though perhaps not only) motiviation
>    of a home agent is reachability as a server. So
>    how do you plan to migrate the A6 records as you
>    are moving in the visited network?
> 
	=> I don't get that. See below.

>    I believe that you end up with two previously 
>    unsolved problems instead of one. Perhaps three,
>    because this is really just renumbering in 
>    disguise.
> 
	=> I don't think so, there are other mechanisms
	(like SIP or DynDNS) that can be used to update
	the user's location. Not having a HA does not mean
	you can't be a server. 

	Hesham

---

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 27 Mar 2001 17:56:00 +0200

>  > > Hesham Soliman  (ERA) writes:
>  > >  > 4. The MN uses DynDNS or SIP to register its Home 
>  > >  >     address. 
>  > > 
>  > >    So do you envision 0 length TTL's? 
>  > > 
>  > 	=> Well if you use DynDNS I guess you 
>  > 	have to. I assume you're referring to the 
>  > 	DynDNS example. SIP is also a possibility
>  > 	for the applications that will use it. 
> 
>    Whether it's SIP or DNS or Oracle 27.0, the implication
>    is a highly available, highly distributed online transaction
>    processing database with suffers many of the same cross
>    realm difficulties that FMIP, etc, are trying to solve
>    (which is, for the most part, local convergence).
> 
>    Do you have an example of an existing system which
>    actually exhibits all of the necessary requirements?
> 
	=> No I don't, and I don't know how far it can scale
	before the whole infrastructure starts shaking ! I was just 
	presenting alternatives. I haven't seen any simulations
	that I can use to know whether this would scale 
	at all.

	Hesham

---

From: Mohan Parthasarathy <[email-masked]>
Date: Tue, 27 Mar 2001 09:37:02 -0800 (PST)

> >
> >
> > > Just to play the Devil's advocate, is mobility important by itself, or
> only
> > > with route optimization?
> >
> > "Mobility" is "more important" than "route optimization".  But allowing
> > the correspondent node to send packets to a mobile node, and (just as
> > important) getting the home agent out of the typical routing path, is an
> > important aspect of the scalability of the protocol.
> 
> Not if the HA is already in or close to in the normal route the packet would
> otherwise take (i.e., "Nearby HA Route Optimization").
> 
I am not sure i understand this completely. Does this mean the home
address of the MN changes at it potentially moves across various
domains ? Or whenever the "distance" increases you would find
a near by HA ?

> >
> > I think this is premature.  We have only just recently gotten a clear
> picture
> > about what is needed from the standpoint of the IESG.  The Binding Update
> > message is, after all, what the mobile node sends to the Home Agent.
> 
> Though the IESG didn't say so in so many words, my distinct impression was
> that the issue is with the security association between MN and CN, not
> between MN and HA.  I don't think anyone is suggesting getting rid of the
> latter.  I certainly wasn't.  Am I wrong on this?
> 
> >
> > Again, a good solution is, I think, within reach.
> >
> 
> I don't know.  The IESG is suggesting a design team.  Sounds like a time
> comsuming process.  Also, Pekka's attack classification has like 15 attack
> capabilities and 10 attack scenarios.  Presumably this represents a minimum
> of the sort of analysis that has to be done on a new scheme.  I just don't
> finishing the process of designing another scheme happening any time soon.
> 
That's why we should use whatever we have today and not pretend to solve
all the problems. Then we don't have to reinvent everything and the 
security analysis becomes simpler assuming somebody has already done
a good amount of analysis on the existing solutions. I think finally
it boils down to the question "How secure the binding updates should
be " ?

-mohan

> Charlie, if we assume that the existing method for establishing SAs and
> sending BUs between MN and HA remain the same as now, are you less opposed
> to the idea of just dropping the MN<>CN SA and BUs only?

---

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Wed, 28 Mar 2001 00:20:55 +0200

> >
> >  > Of course, this mandates AAA for (scalable) MIPv6, which is probably
> not a
> >  > good thing.
> >
> >    Amongst other things. Anything that posits DNS
> >    as being a real time transaction system is dead
> >    in the water.
> >
> 
> I'm not suggesting that DNS be updated for this.  I'm not suggesting
> anything different from what we can do today with IPv4 (for the time being).
> 
> I'm not suggesting we need a new AAA infrastructure.
> 
> I'm not suggesting DynDNS.
> 
> I'm not suggesting we stop pursueing true route optimization.
> 
> All I'm saying is that we move forward with a simple form of MIPv6 that
> provides us with no more capability than we have today with MIPv4.  When you
> roam and authenticate with the local AAA infrastrucuture (PPP and RADIUS and
> CHAP or whatever protocols and infrastructure is already out there today),
> you get assigned an address that ties you to a local HA.  When you are
> mobile, traffic still goes through the local HA.  
> 
	=> The problem is that you still need to send a BU to 
	the local HA. That's why (I believe) Francis saw that it is
	basically HMIPv6 with one level of hierarchy. 
	So somehow you need to establish an SA between the 
	MN and the local HA/MAP ...etc

> Your A6 records are not
> updated, so if you want to act as a server, then it must be through your
> true original HA (not local HA).  (Hmmmm, does MIPv6 today allow for the
> possibility of multiple HAs?  
> 
	=> With HMIPv6 you get that effect. But an SA with 
	the local MAP is needed.

	Hesham