Subject: RE: [mobile-ip] Comments to draft-castelluccia-mobileip-privacy-0 0.txt

From: KASSI-LAHLOU Mohammed FTRD/DMI/CAE <[email-masked]>
Date: Tue, 20 Mar 2001 11:38:13 +0100

Hello,

You know the movement of the mobile node with regard to its home network if
you know well its home address and the location of its home network.
If the home address belongs to a virtual network or if at every new
communication it uses the address obtained in the visited network as a
source address (as specified in draft-kassi-mobileip-dmi-00.txt) you can
know that the mobile node is in movement but without having a point of
departure. So in these cases, the mobile node is never at home or the
location of its home network is not well known.

Regards,

Kassi

-----Message d'origine-----
De : Pekka Nikander [mailto:[email-masked]]
Envoyé : lundi 19 mars 2001 17:56
À : Claude Castelluccia
Cc : MobileIP Mailing List
Objet : [mobile-ip] Comments to
draft-castelluccia-mobileip-privacy-00.txt

Claude,

Here are some half-baked comments to your draft
draft-castelluccia-mobileip-privacy-00.txt

Firstly, I don't immediately see the usability of TMI instead
of just dropping the Home Address altogether, as I suggest
(among other things) in my Homeless Mobile IPv6 draft,
  draft-nikander-mobileip-homelessv6-01.txt

That is, if you use IPsec, you don't need home 
addresses and therefore the home address
destination option is useless.  On the other hand, if
IPsec is not used, the home address destination option
may be faked, and its only use is to try to find out the
supposedly right socket that should receive the packet.
However, if there exists an entry in the Binding Cache,
you can use that entry to look up the right home address
anyway, and therefore you don't need the home address.
Thus, the only reason for sending a home address in the
Home Address Destiation Option is to use it for a Binding
Update.  But then again, you would be using Ipsec....
Ok, I admit that there is the case where you do not or
cannot send a BU but you still want to use your CoA
as the source address and home address in the dest opt.
However, the only reason for that is ingress filtering,
which is broken IMHO anyway.

Secondly, the method that you propose to create TMIs 
actually largely defeats your purpose.  That is, if you know
the home address, you can easily calculate the TMI, and you
can still follow the communications as easily as if you
were using the home address.  This even applies to the
subsequently generated TMIs.

What comes to security, I think that using TMIs would
make it even harder to authorize BUs.  In one way, when
a MN is the client and sends a TMI, it is no different
from e.g. PBK EIDs.  If they are clearly given a separate
address space, as you tentatively suggest, then the
problem might disappear.  However, if you allow overlapping
between TMIs and genuine home addresses, you actually
make it very easy to steal traffic destined to specific
home addresses unless you solve the address ownership problem.

--Pekka

---

From: Pekka Nikander <[email-masked]>
Date: Wed, 21 Mar 2001 19:07:27 +0200

> know that the mobile node is in movement but without having a point of

Nice draft.  Very much in line with our Homeless Mobile IPv6 thinking,
but not going quite that far as we attempt to go.

However, I think that even though the Security Considerations section
may be technically correct, in the practise the situation is different.
That is, one may reasonably assume that a MN has a permanent security
association (in some form) with its permanent or real HA.  However,
I have serious doubts about our ability to provide a scaleable solution
for creating security associations between an MN and the temporary
HA used to forward connections opened while at a foreign link.
Yes, I know, with AAA we most probably will be able to do that, but
I don't believe that AAA will ever scale enough to cover all of the
Internet.  (This is not a technical concern but a deployment concern.)

The case of not having a (conceptual) security association between a MN
and its HA is much harder from the security point of view than the case
where you do have such a security association.  Your grounds for providing
authorization evidence to the CN are much slimmer.  

I suggest that you reconsider your draft in the light of the Mobile IPv6
security discussion to be held tomorrow at the Mobileip WG meeting.

--Pekka