Subject: [nemo] FW: Explicit Prefix Length Option

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Mon, 24 Nov 2003 16:48:04 -0000

Hi Jim,

We've had some discussions inside the DT over the explicit prefix length
option.

As far as we understand it, the explicit prefix does it all. It allows
multiple bundled registrations of network prefixes, together with the
registration of a home address. The downside of that power is a level of
complexity to implement and to deploy (mostly the authorization part of
it).

On the other hand, the explicit prefix length is a simple thing. My view
is that it could be useful to provide a simple deployment model. In that
model, there's an implicit authorization for a mobile router to register
for a given, length configurable, prefix around its home address (iff
there exists an SA with its Home Agent). This limited use case allows
for a very simple configuration and in particular a virtual Home Network
and no specific authorization checking.

I believe that this mode somehow extends the fact that in MIPv6, the
Home Address that is registered is the SA end point, which is already
implicitly an authorization model (the Home Address being registered is
not part of the mobility header anymore that the prefix is present in
explicit prefix length case). So in my view, there's value to the
explicit prefix length option. Also, it does not cost much to implement.
We could suggest that the implicit authorization model applies to
explicit prefix length only, making the 2 paths in the explicit support
code different.

What do you think?

Pascal

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]]
> Sent: vendredi 21 novembre 2003 19:59
> To: Pascal Thubert (pthubert)
> Cc: Ryuji Wakikawa; Vijay Devarapalli
> Subject: Re: Explicit Prefix Length Option
> 
> 
> 
> Pascal Thubert (pthubert) wrote:
> 
> >>
> >>this is not correct. the HA has to still verify that the Mobile
> >>Router is authorized for that prefix, because it could be just
> >>a mobile node, which configured a home address from a prefix
> >>belonging to a Mobile Router and attempting to register with
> >>the Home Agent as a mobile router. the idea to is to prevent
> >>misbehaving mobile nodes/mobile routers.
> >>
> >
> > We do not communicate here. My view here is that the HA has a policy
> > where it has SAs only for MRs which own the /64 around their home
> > address. By policy. It's a limited subcase. When the HA is
configured
> > that way, your case is avoided, by definition.
> 
> >>the combination of IPsec SA for the Home Address, the fact that the
> >>Home Address was configured from the MNP and the use of the Explicit
> >>Prefix Length mode does not still give the Home Agent enough
> >>confidence that the home address claimed in the Binding Update is
> >>authorized to setup forwarding for a particular Mobile Network.
> >>
> >
> >
> > Not in general, but in a particular policy, yes. I think it's a
config
> > issue
> 
> aha, so there are separate IPsec policy entries for Mobile Routers
> which configure their home address from thier MNPs. I am not sure I
> like it. :(
> 
> >>>Vijay, you may want to copy James sometime?
> >>
> >>lets stop with this thread. you might want to write a mail to Jim
> >>and the WG, justifying the Explicit Prefix Length mode. or you can
> >>just disagree with James saying that the savings of 16 bytes is
> >>worth it. that is fine with me too.
> >
> > Right, this entered the usage world. Do you agree to copy the list
as
> > comment on usage?
> 
> Pascal, can you post a short summary of this thread to the mailing
> list and James Kempf? you should in short say why the Explicit
> Prefix Length mode is required. and then lets take it from there.
> I am not entirely convinced Explicit Prefix Length mode is needed.
> but I will keep quiet. :)
> 
> Vijay

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 25 Nov 2003 08:58:55 -0000

> From: James Kempf [mailto:[email-masked]]
> Sent: lundi 24 novembre 2003 18:37
> Cc: [email-masked]
> I don't believe this is acceptible from a mobile service provider
deployment
> standpoint. There needs to be some way for the home network to
authenticate
> the identity of the mobile router to assure that the mobile router is
> authorized to register the prefixes.
> 

It's not what I meant. See below:

> IKEv2 provides a way to use legacy authentication methods within the
Phase 1
> ISAKMP transaction, to authenticate the identity of a host, but
nothing
> specifically for prefixes, so that would have to be arranged somehow.
> Another alternative is to use a certificate, for example, an identity
> certificate containing the new PKIX IP address range extension with
the
> prefixes the mobile router is authorized to route. See
> draft-ietf-pkix-x509-ipaddr-as-extn-03.txt. SEND is using this
extension to
> allow an access router to identify the prefixes it is allowed to
route, and
> SBGP is using it to allow border routers to identify what address
ranges
> they have been assigned by IANA.
> 
> There's an issue in MIPv6 with authorization as well, but because the
host
> is required to have an IPsec SA with the HA, it's not as critical,
since the
> host must prove its identity to either set that up (if its dynamic) or
to
> use it (if its static). If the home address is dynamically assigned,
> however, there is a problem. This is part of the bootstrapping work
item
> that is in the new MIP6 charter.
> 

This is what I was trying to say. Keep the MIPv6 model, and implicitly
extend that authorization to a given prefix length around the static
home address. You can configure that HA to accept the registration for a
prefix around the home address, provided that the MR has proven its
identity (the MIPv6 way), and with a minimum configured prefix length.
The explicit prefix extends the implicit authorization in MIPv6.

Pascal

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 25 Nov 2003 11:41:08 -0000

> From: Alexis Olivereau [mailto:[email-masked]]
> Sent: mardi 25 novembre 2003 12:29
> Subject: Re: [nemo] RE: Explicit Prefix Length Option
> 
> > This is what I was trying to say. Keep the MIPv6 model, and
> > implicitly extend that authorization to a given prefix length around
> >  the static home address. You can configure that HA to accept the
> > registration for a prefix around the home address, provided that the
> >  MR has proven its identity (the MIPv6 way), and with a minimum
> > configured prefix length. The explicit prefix extends the implicit
> > authorization in MIPv6.
> >
> > This is what I was trying to say. Keep the MIPv6 model, and
> > implicitly extend that authorization to a given prefix length around
> >  the static home address.
> 
> I am not sure I understand what you are proposing here. Do you mean
that
> a Mobile Router would be able to claim the ownership of any prefix
above
> a certain length, provided that the prefix is based on its home
address?
> Then I could imagine cases where two Mobile Routers could legitimately
> claim the ownership of the same prefix... Or we need to add more
> constraints on how the MRs' home addresses are assigned.

This is entering the multihomeing discussion. In that case, yes, that
would be possible.
We do not have a test to check that multiple registration of a given MNP
lead to a unique mobile link. With basic, we assume that the
configuration is correct and that the authorization checks that there is
no abuse.

Pascal

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 25 Nov 2003 11:44:16 -0000

> From: Alexandru Petrescu [mailto:[email-masked]]
> Sent: mardi 25 novembre 2003 12:22
> Subject: Re: [nemo] Explicit Prefix Length Option
> 
> >>From: Alexandru Petrescu [mailto:[email-masked]]
> >>Sent: mardi 25 novembre 2003 12:00
> >>Cc: James Kempf; [email-masked]
> >>I think I understand what you're trying to say.  Authorize the Home
> >>Address as MIPv6 does it, and add a model where the value of the
> >
> > prefix
> >
> >>length is authorized too.
> >>
> >>But, an even _simpler_ method is to to authorize the Home Address as
> >>MIPv6 does it, and use the model of the Prefix Table where the
prefix
> >>itself is authorized too.  The Prefix Table is already described in
> >
> > the
> >
> >>base nemo spec.
> >>
> >>
> >>I'm not sure that the current nemo spec has the "extension" you
> >
> > propose.
> >
> >>Or I don't understand the "implicitly"(?)
> >>
> >>Anyways, I'm not saying that that extension of the len authorization
> >>you're mentioning above should be described in the basic support
> >
> > either,
> >
> >>based on the fact some advantages of the explicit prefix mode len
> >>itself (compared to implicit and explicit network modes) are yet to
be
> >>unveiled, IMHO.
> >>
> >>Alex
> >
> > Agreed: this is for the usage draft
> 
> So why not moving the prefix len option together with its yet-to-be
> written authorization entirely in the "usages" draft?
> 
"Usages" is not normative. If we need to standardize something, it's not
the right place. 

Pascal

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 25 Nov 2003 13:21:01 -0000

> Sent: mardi 25 novembre 2003 12:54
> Cc: Alexandru Petrescu; [email-masked]
> > "Usages" is not normative. If we need to standardize something, it's
> > not the right place.
> 
> Yes, combine this with: if we need to standardize something it should
be
> advantageous, secure and straightforward implementation.
> 
Changing subject are you? 

> The only advantage of explicit prefix len mode up to now is savings in
> bit-space in the BU messages.  Please analyze these savings for us.
> 
I was arguing the opposite. I was arguing that it can be used in a
simple implicit authorization model, based on an adapted config/policy
at the HA.

> With respect to security: it is in no way more secure to use the
prefix
> len mode rather than the implicit or the explicit network modes.  It
is
> less secure, see Alexis' post.
> 
I answered that but you assertion was certainly not my conclusion

> Straightforward implementation: there is an implementation of the
> explicit prefix len mode.  It is not straightforward in that it poses
> limits in the ways the Home Addresses are assigned to several mobile
> routers of same HA such that MNP's don't overlap.  It is even less
> straightforward in that it requires an implementer to read the
"usages"
> draft too.
??? When mobile networks are not multihomed then obviously MNPs do not
overlap.
Seems you're confusing things up here.

Pascal