Subject: RE: [mobile-ip] BU Authorization method: design team recommendation

From: [email-masked]
Date: Wed, 6 Feb 2002 10:25:29 +0200

Hi Jari,

> > > 3. Regarding issue (i), the design team recommends that the RR
> > 
> > Can live with this.
> 
> Ok. Hmm... when you say "can live with this", can you
> give some indication of why its only "live with" and
> not "agree"?

'Can live with' rather than 'Agree' because I'm still trying
to sort out the details of RR vs. CGA vs. RR + BSA.  I agree
that that basic RR doesn't need a BSA, however, if someone
wanted additional protection, are you indicating that only 
CGA is applicable?  Are we affectively eliminating RR + BSA
as an option for stronger protection? 

> > > 4. Regarding issue (ii), the design team recommends both CoA
> >
> > Can live with this.

For point 4, it is 'can live with' as opposed to 'agree' basically
because I think it will work, but some WG thinking is needed
(to see if this can be optimized or not) - but I do think that
this is the starting point.

> > > 5. In order to guarantee security of the above exchange, the
> >
> > Can live with this.

Actually,  I will change my 'vote' to AGREE.

> > > 6. For CGA, the design team recommends that 1a/2a can be
> > 
> > Decision on this should be held off, note my concerns above.
> 
> What we tried to do on this one is to evaluate the security
> differences between various cases, and basically the same
> results that in our opinion indicate the repetition of 1a/2a,
> also point to leaving out 1a/2a from CGA in the mentioned
> case.
> 
> Do you have a specific comment on the analysis and do
> you disagree with the relevant part regarding HoA test?

Actually, I will change my vote for AGREE, that with CGA, 
1a/2a is probably not needed.

best regards,
John

---

From: Jari Arkko <[email-masked]>
Date: Wed, 06 Feb 2002 11:00:02 +0200

> as an option for stronger protection?

Ah, I see...

The first conclusion we made was that specific signaling
is always needed with RR anyway on every BU, so having
a BSA does not accomplish much. A lone BSA would actually
be harmful, if you didn't need to do e.g. CoA tests. So
this is the justification why we believe BSA may not buy
us anything in the RR case.

However, I do *not* believe this eliminates any
future options as to the use of BSAs with RR, CGA
or other techniques. My personal opinion on the
use of the BSAs e.g. a la IPsec would be that they
would be *additional* protection on top of RR,
not a replacement.

But I would note that the design team hasn't yet
produced a recommendation on the use of strong
authentication to aid BU authorization. We will
soon, though...

> this is the starting point.

Ok. All discussion on whether there can be
optimizations is of course welcome. The Residual_threats.txt
has tried to discuss why we believe these things are
needed. We'd be very happy in particular if you can
pinpoint something we missed there.

> Actually,  I will change my 'vote' to AGREE.

Great...

> 1a/2a is probably not needed.

Great... thanks again for your input!

Jari

---

From: Michael Thomas <[email-masked]>
Date: Wed, 6 Feb 2002 06:59:08 -0800 (PST)

> would be *additional* protection on top of RR,

   Even in the case of HA/MN? The HA really knows
   the authorization status of the subnet the MN
   is using, therefore possession of the key should
   be sufficient test, right?

		  Mike

---

From: Jari Arkko <[email-masked]>
Date: Wed, 06 Feb 2002 17:11:22 +0200

>    be sufficient test, right?

Sorry for the confusion. I was talking about MN-CN
security in the above. I believe IPsec SA would be
sufficient for the HA-MN security. RR nor CGA would
not be run MN-HA.

Jari

---

From: Jari Arkko <[email-masked]>
Date: Wed, 06 Feb 2002 17:11:22 +0200

Jari