Subject: RE: [nemo] RE: Explicit Prefix Length Option

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 25 Nov 2003 11:41:08 -0000

> -----Original Message-----
> From: Alexis Olivereau [mailto:[email-masked]]
> Sent: mardi 25 novembre 2003 12:29
> To: Pascal Thubert (pthubert)
> Cc: [email-masked]
> Subject: Re: [nemo] RE: Explicit Prefix Length Option
> 
> > Pascal Thubert (pthubert) wrote:
> > This is what I was trying to say. Keep the MIPv6 model, and
> > implicitly extend that authorization to a given prefix length around
> >  the static home address. You can configure that HA to accept the
> > registration for a prefix around the home address, provided that the
> >  MR has proven its identity (the MIPv6 way), and with a minimum
> > configured prefix length. The explicit prefix extends the implicit
> > authorization in MIPv6.
> >
> > This is what I was trying to say. Keep the MIPv6 model, and
> > implicitly extend that authorization to a given prefix length around
> >  the static home address.
> 
> I am not sure I understand what you are proposing here. Do you mean
that
> a Mobile Router would be able to claim the ownership of any prefix
above
> a certain length, provided that the prefix is based on its home
address?
> Then I could imagine cases where two Mobile Routers could legitimately
> claim the ownership of the same prefix... Or we need to add more
> constraints on how the MRs' home addresses are assigned.

This is entering the multihomeing discussion. In that case, yes, that
would be possible.
We do not have a test to check that multiple registration of a given MNP
lead to a unique mobile link. With basic, we assume that the
configuration is correct and that the authorization checks that there is
no abuse.

Pascal

---

From: "James Kempf" <[email-masked]>
Date: Tue, 25 Nov 2003 09:03:04 -0800

Pascall,

I think what Alexis is trying to get at is the following. Suppose there are
two mobile routers, both having IPsec SAs with the HA. One has IP address A
and the other has IP address B. Router A is allowed to route prefix set X
and router B is allowed to route prefix set Y.

What prevents router A from sending a BU with Prefix Option having the
prefixes in set Y, thereby hijacking B's traffic?

This is the point I was trying to get at about service provider deployment
security (sorry if I was a bit cryptic).

            jak