Subject: RE: [mobile-ip] Unresolved issue #7: MH format

From: "Karen E Nielsen (TED)" <[email-masked]>
Date: Thu, 2 May 2002 10:36:46 +0200

Hi Francis,

>  In your previous mail you wrote:
> 
>    It is still not really clear to me why you need the HoA 
> inside the BU ?!
>    
> => in order to protect it in any case.
> 
>    In BU's sent to HA protected by IPSEC, the HoA needs to be present
>    in the HAO anyway, and then couldn't the IPSEC SA check 
> authenticate
>    the HoA ?
>    
> => this is *not* true: if the IPsec transform is not AH, the 
> HAO is not
> covered by the integrity check and it is authenticated only by the SA
> lookup (i.e. not by the crypto, only by (reusing Mike Thomas' words)
> an access-list mechanism).
> 

An why is it that this (SA lookup) isn't good enough ? 

If the HoA in HAO has been changed, the packet will not match the SA lookup and will  
be discarded and we're happy - or ??

>    In BU's sent to HA protected by some other means, e.g., some
>    authentication data, couldn't the HoA still be placed in a HAO and
>    then be authenticated via the BU validation ?
>    [...]
> 
> => same answer: to put the HA in the BU just makes things simpler
> (and security things must be simple in order to be secure).   
> Another argument is to make the BU self-sufficient ables non-standard
> way to transport the BU (piggy-backing into an AAA AVP for instance).

In such special cases (ala piggy-backing into an AAA AVP for instance).
the HoA could be inserted as an option in the BU. This should not be
the (only) argument for mandating its presence in ALL BU's - Or..

BR,
Karen

---

From: Francis Dupont <[email-masked]>
Date: Thu, 02 May 2002 11:31:35 +0200

=> an access-list like check is far weaker than a crypto-based integrity
and authentication check, and IMHO too weak (i.e. not good enough).

   If the HoA in HAO has been changed, the packet will not match the
   SA lookup and will be discarded and we're happy - or ??
   
=> it is ridiculous to rely on this when a crypto-based check is
available. IMHO to make the HoA optional is a poor design decision,
and I am happy it is *not* optional.

   > => same answer: to put the HoA in the BU just makes things simpler
   
   In such special cases (ala piggy-backing into an AAA AVP for instance).
   the HoA could be inserted as an option in the BU.

=> I've already given my opinion about optional HoA.

   This should not be the (only) argument for mandating its presence
   in ALL BU's - Or..
   
=> this is not the only argument, just a fine side-effect...

Regards

[email-masked]

---

From: Michael Thomas <[email-masked]>
Date: Thu, 2 May 2002 06:59:19 -0700 (PDT)

> An why is it that this (SA lookup) isn't good enough ? 

Karen,

SA's are not looked up by source IP addresses.
They only consider the SPI with the sole exception
of multicast where it's SPI/DstAddr.

 > the (only) argument for mandating its presence in ALL BU's - Or..

I assume that you're concerned about bandwidth?
See my question about the possibility of eliding
the HAO.

		Mike