Subject: [nemo] RE: Explicit Prefix Length Option

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 25 Nov 2003 08:58:55 -0000

> -----Original Message-----
> From: James Kempf [mailto:[email-masked]]
> Sent: lundi 24 novembre 2003 18:37
> To: Pascal Thubert (pthubert)
> Cc: [email-masked]
> Subject: Re: Explicit Prefix Length Option
> 
> 
> > On the other hand, the explicit prefix length is a simple thing. My
view
> > is that it could be useful to provide a simple deployment model. In
that
> > model, there's an implicit authorization for a mobile router to
register
> > for a given, length configurable, prefix around its home address
(iff
> > there exists an SA with its Home Agent). This limited use case
allows
> > for a very simple configuration and in particular a virtual Home
Network
> > and no specific authorization checking.
> >
> 
> I don't believe this is acceptible from a mobile service provider
deployment
> standpoint. There needs to be some way for the home network to
authenticate
> the identity of the mobile router to assure that the mobile router is
> authorized to register the prefixes.
> 

It's not what I meant. See below:

> IKEv2 provides a way to use legacy authentication methods within the
Phase 1
> ISAKMP transaction, to authenticate the identity of a host, but
nothing
> specifically for prefixes, so that would have to be arranged somehow.
> Another alternative is to use a certificate, for example, an identity
> certificate containing the new PKIX IP address range extension with
the
> prefixes the mobile router is authorized to route. See
> draft-ietf-pkix-x509-ipaddr-as-extn-03.txt. SEND is using this
extension to
> allow an access router to identify the prefixes it is allowed to
route, and
> SBGP is using it to allow border routers to identify what address
ranges
> they have been assigned by IANA.
> 
> > I believe that this mode somehow extends the fact that in MIPv6, the
> > Home Address that is registered is the SA end point, which is
already
> > implicitly an authorization model (the Home Address being registered
is
> > not part of the mobility header anymore that the prefix is present
in
> > explicit prefix length case). So in my view, there's value to the
> > explicit prefix length option. Also, it does not cost much to
implement.
> > We could suggest that the implicit authorization model applies to
> > explicit prefix length only, making the 2 paths in the explicit
support
> > code different.
> >
> 
> There's an issue in MIPv6 with authorization as well, but because the
host
> is required to have an IPsec SA with the HA, it's not as critical,
since the
> host must prove its identity to either set that up (if its dynamic) or
to
> use it (if its static). If the home address is dynamically assigned,
> however, there is a problem. This is part of the bootstrapping work
item
> that is in the new MIP6 charter.
> 

This is what I was trying to say. Keep the MIPv6 model, and implicitly
extend that authorization to a given prefix length around the static
home address. You can configure that HA to accept the registration for a
prefix around the home address, provided that the MR has proven its
identity (the MIPv6 way), and with a minimum configured prefix length.
The explicit prefix extends the implicit authorization in MIPv6.

Pascal

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 25 Nov 2003 12:00:09 +0100

Pascal Thubert (pthubert) wrote:
> This is what I was trying to say. Keep the MIPv6 model, and 
> implicitly extend that authorization to a given prefix length around
>  the static home address. You can configure that HA to accept the 
> registration for a prefix around the home address, provided that the
>  MR has proven its identity (the MIPv6 way), and with a minimum 
> configured prefix length. The explicit prefix extends the implicit 
> authorization in MIPv6.

I think I understand what you're trying to say.  Authorize the Home
Address as MIPv6 does it, and add a model where the value of the prefix
length is authorized too.

But, an even _simpler_ method is to to authorize the Home Address as
MIPv6 does it, and use the model of the Prefix Table where the prefix
itself is authorized too.  The Prefix Table is already described in the
base nemo spec.

> This is what I was trying to say. Keep the MIPv6 model, and 
> implicitly extend that authorization to a given prefix length around
>  the static home address.

I'm not sure that the current nemo spec has the "extension" you propose.

Or I don't understand the "implicitly"(?)

Anyways, I'm not saying that that extension of the len authorization
you're mentioning above should be described in the basic support either,
based on the fact some advantages of the explicit prefix mode len
itself (compared to implicit and explicit network modes) are yet to be
unveiled, IMHO.

Alex

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 25 Nov 2003 12:00:09 +0100

Alex

---

From: Alexis Olivereau <[email-masked]>
Date: Tue, 25 Nov 2003 12:28:44 +0100

> implicitly extend that authorization to a given prefix length around

I am not sure I understand what you are proposing here. Do you mean that
a Mobile Router would be able to claim the ownership of any prefix above
a certain length, provided that the prefix is based on its home address? 
Then I could imagine cases where two Mobile Routers could legitimately
claim the ownership of the same prefix... Or we need to add more
constraints on how the MRs' home addresses are assigned.

---

From: Alexis Olivereau <[email-masked]>
Date: Tue, 25 Nov 2003 12:28:44 +0100

---

From: "James Kempf" <[email-masked]>
Date: Tue, 25 Nov 2003 08:49:46 -0800

> The explicit prefix extends the implicit authorization in MIPv6.

And, as I said in the original email, I don't believe that would be
acceptable from a mobile service provider deployment standpoint, since it
doesn't rule out a mobile router that isn't authorized to route a particular
prefix from claiming that it is.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Tue, 25 Nov 2003 08:49:46 -0800

jak