Subject: [nemo] FW: Explicit Prefix Length Option

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Mon, 24 Nov 2003 16:48:04 -0000

Hi Jim,

We've had some discussions inside the DT over the explicit prefix length
option.

As far as we understand it, the explicit prefix does it all. It allows
multiple bundled registrations of network prefixes, together with the
registration of a home address. The downside of that power is a level of
complexity to implement and to deploy (mostly the authorization part of
it).

On the other hand, the explicit prefix length is a simple thing. My view
is that it could be useful to provide a simple deployment model. In that
model, there's an implicit authorization for a mobile router to register
for a given, length configurable, prefix around its home address (iff
there exists an SA with its Home Agent). This limited use case allows
for a very simple configuration and in particular a virtual Home Network
and no specific authorization checking.

I believe that this mode somehow extends the fact that in MIPv6, the
Home Address that is registered is the SA end point, which is already
implicitly an authorization model (the Home Address being registered is
not part of the mobility header anymore that the prefix is present in
explicit prefix length case). So in my view, there's value to the
explicit prefix length option. Also, it does not cost much to implement.
We could suggest that the implicit authorization model applies to
explicit prefix length only, making the 2 paths in the explicit support
code different.

What do you think?

Pascal

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]]
> Sent: vendredi 21 novembre 2003 19:59
> To: Pascal Thubert (pthubert)
> Cc: Ryuji Wakikawa; Vijay Devarapalli
> Subject: Re: Explicit Prefix Length Option
> 
> 
> 
> Pascal Thubert (pthubert) wrote:
> 
> >>
> >>this is not correct. the HA has to still verify that the Mobile
> >>Router is authorized for that prefix, because it could be just
> >>a mobile node, which configured a home address from a prefix
> >>belonging to a Mobile Router and attempting to register with
> >>the Home Agent as a mobile router. the idea to is to prevent
> >>misbehaving mobile nodes/mobile routers.
> >>
> >
> > We do not communicate here. My view here is that the HA has a policy
> > where it has SAs only for MRs which own the /64 around their home
> > address. By policy. It's a limited subcase. When the HA is
configured
> > that way, your case is avoided, by definition.
> 
> >>the combination of IPsec SA for the Home Address, the fact that the
> >>Home Address was configured from the MNP and the use of the Explicit
> >>Prefix Length mode does not still give the Home Agent enough
> >>confidence that the home address claimed in the Binding Update is
> >>authorized to setup forwarding for a particular Mobile Network.
> >>
> >
> >
> > Not in general, but in a particular policy, yes. I think it's a
config
> > issue
> 
> aha, so there are separate IPsec policy entries for Mobile Routers
> which configure their home address from thier MNPs. I am not sure I
> like it. :(
> 
> >>>Vijay, you may want to copy James sometime?
> >>
> >>lets stop with this thread. you might want to write a mail to Jim
> >>and the WG, justifying the Explicit Prefix Length mode. or you can
> >>just disagree with James saying that the savings of 16 bytes is
> >>worth it. that is fine with me too.
> >
> > Right, this entered the usage world. Do you agree to copy the list
as
> > comment on usage?
> 
> Pascal, can you post a short summary of this thread to the mailing
> list and James Kempf? you should in short say why the Explicit
> Prefix Length mode is required. and then lets take it from there.
> I am not entirely convinced Explicit Prefix Length mode is needed.
> but I will keep quiet. :)
> 
> Vijay

---

From: "James Kempf" <[email-masked]>
Date: Mon, 24 Nov 2003 09:36:41 -0800

> and no specific authorization checking.

I don't believe this is acceptible from a mobile service provider deployment
standpoint. There needs to be some way for the home network to authenticate
the identity of the mobile router to assure that the mobile router is
authorized to register the prefixes.

IKEv2 provides a way to use legacy authentication methods within the Phase 1
ISAKMP transaction, to authenticate the identity of a host, but nothing
specifically for prefixes, so that would have to be arranged somehow.
Another alternative is to use a certificate, for example, an identity
certificate containing the new PKIX IP address range extension with the
prefixes the mobile router is authorized to route. See
draft-ietf-pkix-x509-ipaddr-as-extn-03.txt. SEND is using this extension to
allow an access router to identify the prefixes it is allowed to route, and
SBGP is using it to allow border routers to identify what address ranges
they have been assigned by IANA.

> explicit prefix length only, making the 2 paths in the explicit support

There's an issue in MIPv6 with authorization as well, but because the host
is required to have an IPsec SA with the HA, it's not as critical, since the
host must prove its identity to either set that up (if its dynamic) or to
use it (if its static). If the home address is dynamically assigned,
however, there is a problem. This is part of the bootstrapping work item
that is in the new MIP6 charter.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Mon, 24 Nov 2003 09:36:41 -0800

jak