Subject: RE: [mobile-ip] BU Authorization method: design team recommendati on

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 11 Feb 2002 17:20:08 +0100

Erik, 

  > 
  > Also, it wasn't clear from the draft how the AAA does the 
  > authorization
  > of an address.
  > Imagine I (NAI=[email-masked]) appear at some random ISP
  > and get authenticated.
  > The ISP assigned me a CoA (e.g. using RC 2462 stateless addrconf)
  > and I communicate with the AAA.
  > Is the assumption that my AAAh has a pre-configured list 
  > mapping NAI->home 
  > address for all nodes in sun.com?

=> Yes, also see :
http://search.ietf.org/internet-drafts/draft-soliman-mobileip-routeopt-mipv6-02.txt

But before that please see below.

  > What if my home network renumbers (mipv6 allows for this) - 
  > how does this
  > mapping get updated?

=> In a very difficult way !

  > What if my MN wants to use a RFC 3041 home address - how 
  > does the mapping
  > in my home AAA get updated?

=> Same as above :)
Our (the authorsof this draft) conclusion was that
this solution was needed in the absence of an e2e
infrastructureless solution, and assuming that AAA
will be deployed widely. Also this solution would need
extensive standardisation between PANA and AAA. 
Since now we saw that there is a more secure (*) 
infrastructureless way of doing things (RR or RR+CGA), 
I don't see any technical advantage for pursuing the
AAA approach. Previously the main advantage was that
it can be used to authorise addresses (assuming 
AAA servers trusted each other).

Hesham

(*) RR + CGA is more secure since the AAA servers
will not know the keys.

---

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Wed, 13 Feb 2002 18:12:37 +0100

James,

  > I'm thinking about securing paging and maybe other kinds of
  > IPv6 signaling, like ND. I think CGAs  or something similar
  > may have some applicablity here, RR certainly doesn't. Or
  > maybe BSAs, though that seems too heavyweight.
  > 
  > As for LMM, I assume the same RR would need to be done
  > with an LMM agent, unless the MN was prepared to
  > trust the local network and not do so. Or use a BSA,
  > as you state. A BSA would be alot better.

=> A BSA would require something more than RR
(see the residual threats draft and Pekka N email
about these types of attacks). This is one of 
the reason for suggesting CGAs to be done in the
context of MIP ASAP the current WG drafts are
unlikely to proceed or perform as we would 
like them to (FMIP HMIP ...etc) unless
we have a stronger solution for security. 
I'm pretty sure this WG does not want to go 
through another rework of all drafts because
we didn't consider the security solutions for
each one. 

I'm not saying put CGAs in the MIPv6 standard, 
but let's make sure the 'option' is standardised
ASAP so we can move on. 

Hesham

  >             jak