Subject: RE: [NSIS] RE: nsis mobility interactions

From: "Hancock, Robert" <[email-masked]>
Date: Wed, 30 Oct 2002 11:15:21 -0000

hi all,

will someone explain to me how the security (validation of HA ownership in the network interior) and performance (required complexity of packet classifier) issues with this approach would be addressed? (no pun intended.)

robert h.

> -----Original Message-----
> From: Sarantis Paskalis [mailto:[email-masked]]
> Sent: 30 October 2002 11:01
> To: Hannes Tschofenig
> Cc: [email-masked]; Hancock, Robert; [email-masked]
> Subject: Re: [NSIS] RE: nsis mobility interactions
> 
> 
> Hi all,
> 
> On Wed, Oct 30, 2002 at 08:57:56AM +0100, Hannes Tschofenig wrote:
> > i saw that "draft-ietf-ipv6-flow-label-03.txt" recommends 
> classification
> > based on triplet (src adr, dest adr, flow label). in case 
> of mobility it
> > would be much better to use the home address instead of the 
> source address.
> > with a source address as part of the classifier all nodes 
> along the path
> > require an update after the src address changed due to mobility.
> 
> Or better Home Addresses, since both the source and the 
> destination may
> be mobile nodes.  Home Addresses remain constant at least throughout a
> session, so they can be used to identify the same flow.
> 
> -- Sarantis
> 
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 30 Oct 2002 13:19:05 +0100

hi robert

the mobile ipv6 address ownership problem (establishing end-to-end security
associations between two arbitrary hosts) is independent from the session
ownership issues in nsis. i think that an nsis protocol does not care
whether it has to install/update a flow identitifer with a care-of address
or something different (home address, flow label).

the performance aspect is worth a consideration. however, i do not have
performance numbers. does someone else know something?

ciao
hannes

> From: Hancock, Robert [mailto:[email-masked]]
> Sent: Wednesday, October 30, 2002 12:15 PM
> To: 'Sarantis Paskalis'; Hannes Tschofenig
> Cc: [email-masked]; [email-masked]
> Subject: RE: [NSIS] RE: nsis mobility interactions
>
>
> hi all,
>
> will someone explain to me how the security (validation of HA
> ownership in the network interior) and performance (required
> complexity of packet classifier) issues with this approach would
> be addressed? (no pun intended.)
>
> robert h.
>

---

From: Michael Thomas <[email-masked]>
Date: Wed, 30 Oct 2002 08:20:16 -0800 (PST)

ownership in the network interior) and performance (required
complexity of packet classifier) issues with this approach would be
addressed? (no pun intended.)

Robert,

How is it done today? BCP 38 gives some guidence
but is far from perfect. The Home Address Option,
however, makes edge ingress filtering essentially
impossible as BCP 38 counts on edge routers
understanding their local topology such that they
can perform RPF checks, etc. This cannot be done
with the Home Address Option as the addresss...
isn't necessarily topologically local.

Thus, it seems to me that expecting security
properties to be enforced based on arbitrary home
addresses is a hopeless task. However, I'm not
convinced that that is even needed as the
relationships in RSVP (and assumedly NSIS) are
always hopwise, and given the desire for ingress
filtering I'd expect that topologically correct
CoA's to be the norm. 

This entire discussion is very reminiscent of 
HIP discussions and RFC 2207 considerations.

		Mike