Subject: [MEXT] Well-known problem with authentication/etc. in wireless networks

From: "Charles E. Perkins" <[email-masked]>
Date: Wed, 24 Aug 2011 12:06:18 -0700

Hello folks,

It's now 2011.  Mobile IP was standardized late in
1996, after work had already been started nearly
ten years before.  Over two decades! -- and regardless
of lip service to fixed/mobile convergence we still
don't have seamless mobility in user devices across
heterogeneous media, and standards organizations
(notably 3GPP) are not properly taking advantage of
what Mobile IP can do. The losers are the end-users,
which means all of us.

There are many reasons for this, but one of the
main reasons has to do with authentication at the
access network.  EAP in various forms is being
utilized for this purpose, and Mobile IP is not,
even though there has never been any reported
failure of the RFC 5944 or RFC 4285 or RFC 6275
(to my knowledge).  Moreover, unless there is
something wrong with the cryptography that also
has not been reported, these authentication methods
enable _mutual_ authentication between the network
and the client, not just client authentication.

In order for Mobile IP to enable the real promise
of high performance heterogeneous networking, we
have to do some more work.  I would like to initiate
some more discussion about this.  DMM is interesting
in its own right, but it's not at all the whole
story.  Moreover, with proper design, it is likely
the supposed burden of signaling to the home agent
can be substantially reduced.  As one simple example,
if handovers are accomplished locally between trusted
access agents (routers, 802.11 access controllers, ...)
then the actual timing of tunnel redirection from the
home agent becomes much less critical.  This is also
intricately intertwined with authentication.

If the Home Agent were recognized as a robust security
appliance, then it could naturally sit on the network
boundary as an IP-addressable device.  Mobile IP
authentication could become the primary means of
validating user access, instead of an afterthought
to enable IP-address preservation after all the heavy
lifting has been done a lower levels.

I would like to propose that in this working group we
should go about making this happen.  It seems to be
important, and undeniably aligned with our working
group responsibilities.

Regards,
Charlie P.

---

From: Alper Yegin <[email-masked]>
Date: Thu, 25 Aug 2011 11:48:58 +0300

Hi Charlie,

> lifting has been done a lower levels.

Do you mean using Mobile IP protocol for (local area) network access authentication? Or, something else?

Alper

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 25 Aug 2011 09:28:14 -0700

Hello Alper,

Here is a diagram that might help.

AS == Authentication server  (AAA server)
AR == AAA relay
EA == EAP authenticator
UE == User Equipment == mobile node
                      == access terminal == ...

Then,

UE --- EA --- AS         is a schematic diagram for 802.1x

We can have AAA relays:

UE --- EA --- AR --- AS

I can't think of any reason not to allow
HA as AR in this protocol exchange.  And
then as part of the protocol operation the
home agent should be very simply able to
update its binding cache.

But this is just one example, using 802.1x.
Of course others are possible and important
in various circumstances.  Why aren't we
there in all of those circumstances?

In the above diagram, we might also design EAP
signaling for mutual authentication in a single
round trip.  Why not?  If EAP is the magic
incantation that makes operators comfortable,
why not use it?

Regards,
Charlie P.

On 8/25/2011 1:48 AM, Alper Yegin wrote:
> _______________________________________________
> MEXT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mext

---

From: Julien Laganier <[email-masked]>
Date: Thu, 25 Aug 2011 10:44:46 -0700

Charlie,

I am not sure I understand what is missing in MIPv6; a MN and an HA
can already mutually authenticate using EAP, and this is incidentally
what 3GPP leverages on, together with the EAP-AKA method. What is
missing?

--julien

---

From: Pete McCann <[email-masked]>
Date: Thu, 25 Aug 2011 14:40:33 -0400

Hi, Julien,

Are you talking about EAP inside IKEv2?  That presupposes that the MN
is already attached to the network somewhere and has an IP address (i.e.,
it has already passed access authentication).

It may be interesting to look at whether access authentication and mobility
management can be combined.  For example, we could put Mobile IP (or
some variant of it) inside an EAP exchange used for access authentication.
Charlie, are you proposing something like this?

-Pete

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 25 Aug 2011 12:19:46 -0700

Hello Pete,

Yes, putting Mobile IP inside of EAP would be one approach.
It would have some interesting advantages.  Other approaches
might be more properly done in [netext] -- or perhaps have
already been looked; I could have possibly missed some of
the relevant discussion there.

Regards,
Charlie P.

On 8/25/2011 11:40 AM, Pete McCann wrote:
> On Thu, Aug 25, 2011 at 1:44 PM, Julien Laganier<[email-masked]>  wrote:
>> Charlie,
>>

---

From: Alper Yegin <[email-masked]>
Date: Thu, 25 Aug 2011 22:50:02 +0300

Charlie,

Lot of possibilities exist. EAP over Mobile IP, Mobile IP over EAP, etc. We can also blend in other protocols as well.

But I'm not clear on the problem statement. What are we trying to achieve, can we narrow that down?

Thanks.

Alper

---

From: Pete McCann <[email-masked]>
Date: Thu, 25 Aug 2011 15:54:43 -0400

Hi, Charlie,

The problem seems to be we have the following three steps that have
to be carried out in order:

1) access authentication
2) address assignment
3) mobility management

(3) depends on (2) because you can't bind your home address to a
care-of address until you have a care-of address.  (2) depends on (1)
because operators don't like to give out resources until they know they
will get paid.

It's possible to combine all these things into one protocol (perhaps PANA
could have been that vehicle, if certain decisions had not been made) but
the IETF seems to like breaking problems down into layered solutions.

-Pete

---

From: <[email-masked]>
Date: Thu, 25 Aug 2011 20:05:38 +0000

That¹s a good summarization Pete.
But we do multiple authentications today.
We do access authentication (1) and then we have to authenticate with the
HA yet again in (3).
That could be optimized.

-Raj

---

From: Pete McCann <[email-masked]>
Date: Thu, 25 Aug 2011 16:15:38 -0400

> We do access authentication (1) and then we have to authenticate with the

Indeed.  It should be possible to borrow some keying material from (1)
to create an SA with an HA.  And you wouldn't necessarily use that SA
until you moved away from the initial point of attachment.

-Pete

---

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 25 Aug 2011 13:23:46 -0700

Hello Pete,

Your analysis of operator concerns is quite correct,
it seems to me, but on the other hand maybe the IETF
would be able to alleviate operator concerns once
they are properly understood.  And, if operators
could be assured that they would suffer no harm by
following some revised IETF protocol steps, there
would be a good chance for progress.

Address assignment is perhaps the stickiest case.
Here are some observations:
- The UE doesn't necessarily have to know its
   care-of address until after handover is complete
   (and, according to [netext], not even then)
- The access network does not have to complete the
   assignment of the care-of address until it has
   verified the authentication
- As mentioned before, the home agent is a viable
   candidate for AAA relay, actually appearing as the
   AAA server to the access network
- An IPv6 address can't really be considered a
   valuable resource if it isn't routable, and so
   even if UE knew its IPv6 care-of address, it would
   not get any benefit until authentication completes.

If there is any disagreement about these points, I would
be surprised, but every day brings new surprises.  I am
proposing that we should try to make a higher-performance
handover specification that is less complicated than, say,
S101/S102/S103.  Almost anything the IETF could possibly
do would be less complicated than those, and I fully
expect much easier to configure, administer, and operate.

So, the problem statement could be:

Enable Mobile IP to provide high-performance mobility management that
is better able to be deployed in modern wireless access networks
that already utilize alternate access authentication protocols.
Determine the suitability of network-based versus client-based
variations of the candidate solutions.

Regards,
Charlie P.

---

From: Jong-Hyouk Lee <[email-masked]>
Date: Thu, 25 Aug 2011 22:23:33 +0200

authentication for access network and authentication for binding update are
different.

On Thu, Aug 25, 2011 at 10:05 PM, <[email-masked]> wrote:

> >>> On Thu, Aug 25, 2011 at 1:44 PM, Julien Laganier<[email-masked]
> >
> >>>  wrote:
> >>>>
> >>>> Charlie,
> >>>>

-- 
IMARA Team, INRIA, France.
Jong-Hyouk Lee, living somewhere between /dev/null and /dev/random.

#email: hurryon (at) gmail (dot) com || jong-hyouk.lee (at) inria (dot) fr
#webpage: https://sites.google.com/site/hurryon/

---

From: <[email-masked]>
Date: Thu, 25 Aug 2011 20:24:59 +0000

>until you moved away from the initial point of attachment.

I don’t know Charlie's thoughts regarding EAP.
But if EAP is used in access authentication, then it could potentially
provide keying and bootstrapping material to the MN during the access
authentication phase. The SA with the assigned HA is then setup using that
keying material.

-Raj

---

From: <[email-masked]>
Date: Thu, 25 Aug 2011 20:29:41 +0000

A BU is processed by an HA if there is a valid SA between the MN and HA. So the point is if the SA can be established (using material from the access auth) without having to do another authentication in IKEv2.

From: ext Jong-Hyouk Lee <[email-masked]<mailto:[email-masked]>>
Date: Thu, 25 Aug 2011 22:23:33 +0200
To: Basavaraj Patil <[email-masked]<mailto:[email-masked]>>
Cc: <[email-masked]<mailto:[email-masked]>>, Charles Perkins <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: Re: [MEXT] [!! SPAM] Re: Well-known problem with authentication/etc. in wireless networks

authentication for access network and authentication for binding update are different.

On Thu, Aug 25, 2011 at 10:05 PM, <[email-masked]<mailto:[email-masked]>> wrote:

-Raj

On 8/25/11 2:54 PM, "ext Pete McCann" <[email-masked]<mailto:[email-masked]>> wrote:

><[email-masked]<mailto:[email-masked]>> wrote:
>> Hello Pete,
>>
>>> On Thu, Aug 25, 2011 at 1:44 PM, Julien Laganier<[email-masked]<mailto:[email-masked]>>
>>>  wrote:
>>>>
>>>> Charlie,
>>>>
>>>> <[email-masked]<mailto:[email-masked]>>  wrote:
>>>>>
>>>>> Hello folks,
>>>>>
>>>>> [email-masked]<mailto:[email-masked]>
>>>> [email-masked]<mailto:[email-masked]>
>[email-masked]<mailto:[email-masked]>

_______________________________________________
MEXT mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mext

---

From: <[email-masked]>
Date: Thu, 25 Aug 2011 20:43:31 +0000

Hi Charlie,

Inline:

>variations of the candidate solutions.

I think that the above problem statement is still fairly vague.
What would be the benchmark mobility protocol against which you could
evaluate whether you have a high-performance mobility management protocol?
I think we can work on optimizations to Mobile IP which would make it more
attractive from a deployment perspective.
Simplifying Mobile IP would also help in making it more viable for use in
wireless/cellular networks.
Mobile IP (DSMIP6) can be deployed and used in current gen cellular
networks when the MN is attached to a wifi network or a non-3GPP access
network (S2c reference point in 3GPP). That¹s a start. Relevant use-cases
would ensure that the HA is a part of the P-GW and mobile hosts
implement/support client functionality.

-Basavaraj

>>>> On Thu, Aug 25, 2011 at 1:44 PM, Julien
>>>>Laganier<[email-masked]>
>>>>   wrote:
>>>>>
>>>>> Charlie,
>>>>>

---

From: Pete McCann <[email-masked]>
Date: Thu, 25 Aug 2011 16:56:01 -0400

Hi, Charlie,

>  (and, according to [netext], not even then)

Some agent somewhere has to know it prior to binding it to a
home address.

>  verified the authentication

What do you mean by "complete"?

>  not get any benefit until authentication completes.

I assume a visited network would allocate at least
a /64 and probably more (a shorter prefix) if it wanted
to enable NEMO.  Depending on the amount of address
space allocated to that particular point of attachment,
I could imagine it being quickly exhausted by an attacker
that didn't have to pass authentication.  And given that
cells are getting smaller and more numerous, there will
be less and less address space allocated to each one.

> expect much easier to configure, administer, and operate.

If we could simply convince 3GPP operators to allow direct
Internet access as the default option (in the LIPA style) I
think it would tend to dramatically cut down on the complex
interfaces.  Right now the default option seems to be home-routed
traffic and hiding mobility from the UE as much as possible.

> variations of the candidate solutions.

It would be nice if EAP could be used as an air interface authentication
method in an LTE network.  If we had that and direct LIPA style connectivity
it would be possible to build something interesting on top.

-Pete

---

From: Julien Laganier <[email-masked]>
Date: Thu, 25 Aug 2011 14:02:42 -0700

Hi Pete,

> it has already passed access authentication).

Yes, EAP authentication for IKEv2. Yes the MN needs to attach to the
network first, as hosts currently do today already.

> management can be combined.

I don' t know what problem we would be solving by combining the two.

--julien

---

From: Pete McCann <[email-masked]>
Date: Thu, 25 Aug 2011 18:12:54 -0400

Hi, Julien,

> network first, as hosts currently do today already.

Right.  I think Charlie was asking whether MIP could be the network access
authentication protocol.

> I don' t know what problem we would be solving by combining the two.

Making initial establishment of the SA with the HA (upon network attachment)
more efficient.  Making handovers faster and more efficient by reducing the
number of round-trip messages required.

-Pete

---

From: Julien Laganier <[email-masked]>
Date: Thu, 25 Aug 2011 15:39:33 -0700

Hi Pete,

> number of round-trip messages required.

In the context of this discussion, optimizing Mobile IPv6 handover
speed seems to imply that slowness of those is the root cause of that
lack of MIPv6 deployment, which I don' t think is the case. On the
other hand, coupling network access authentication with mobility
management would arguably reduces deployment flexibility and thus harm
rather than help potential MIPv6 deployments.

Thus I am still not sure what the problem is.

--julien

---

From: Pete McCann <[email-masked]>
Date: Thu, 25 Aug 2011 22:23:45 -0400

Hi, Julien,

> rather than help potential MIPv6 deployments.

You're right that performance is probably not why 3GPP went the
way they did.  I think there were a variety of motivations that boil
down to a desire on the part of operators to control the handling
of UE traffic, mainly by routing it back through policy enforcement
points.  They built a network-based mobility management scheme
that borrowed very little from Mobile IP.

There was also a legacy authentication infrastructure built around
AKA that they wanted to re-use.  They didn't build algorithm agility
into their UE authentication protocol.  One could argue that in an
LTE network the mobility is very much tied to the access authentication,
and it's one reason why MIPv6 has missed the boat here.

> Thus I am still not sure what the problem is.

There's probably very little impetus for change no matter what MEXT
does.

-Pete

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 26 Aug 2011 11:38:12 -0700

Hello Pete,

I might be stepping out on another limb here, but
anyway...

On 8/25/2011 7:23 PM, Pete McCann wrote:

> way they did. ...

Check.

> and it's one reason why MIPv6 has missed the boat here.

Double check.

>> Thus I am still not sure what the problem is.

The problem is that they can't do very effective handovers.
Worse, they are designing _per-application_ handover systems.
This is wrong by most reasonable engineering standards,
regardless on the positive effect it might have for
standards junkies and permanent employment for engineers.

> There's probably very little impetus for change no matter what MEXT

I agree that, if [mext] does nothing,
there won't be much impetus for change.
But if we do something that is (a) secure,
(b) deployable, (c) easier to administer,
and (d) considerably better performance,
then I reckon they'd have to be purposefully
resistant to insist on ignoring it.

Regards,
Charlie P.

---

From: <[email-masked]>
Date: Fri, 26 Aug 2011 19:01:24 +0000

Hi Charlie,

>standards junkies and permanent employment for engineers.

Effective handovers between what networks? Handovers within the scope of
an HSPA or LTE access for example work fine.
If you are referring to handovers between 3G accesses and wifi (non-3GPP
access) then yes.
But the handover performance in such a scenario is hampered by other
factors such as latency in connectivity and authentication etc.

-Basavaraj

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 26 Aug 2011 12:25:11 -0700

Hello Basavaraj,

Thanks for your correction/clarification.

Yes, I agree that in certain cases LTE can
do very fast handovers, of course, given the
installation of sufficiently high-performance
hardware to handle the additional signaling
requirement as designed for the special cases,
or homogeneous physical media.  And,
eventually, they could do fast handovers
for all physical media, with perhaps m*n^^2
hardware solutions for m applications and
n physical media.

I think that we could reasonably expect to
do better handovers in almost all cases
with a more flexible design based on Mobile IP,
FMIP, and PMIP.

I also agree that handovers are hampered by
authentication requirements serialized after
link establishment.  Pre-registration techniques
have been shown to ameliorate this problem
quite well even with "single-radio" handset
operation.  This "should" have been integrated
with FMIP, in my opinion.

Regards,
Charlie P.

On 8/26/2011 12:01 PM, [email-masked] wrote:
>
> Hi Charlie,
>
> On 8/26/11 1:38 PM, "ext Charles E. Perkins"<[email-masked]>  wrote:
>>

---

From: Julien Laganier <[email-masked]>
Date: Fri, 26 Aug 2011 13:00:29 -0700

Hi Raj,

> factors such as latency in connectivity and authentication etc.

In the latter (handover between 3GPP and non-3GPP), given that the
source and target system are accessed by different radio systems, I do
not see handover performance has a factor hampering the usability or
desirability of the inter-system handover scheme in use.

--julien

---

From: <[email-masked]>
Date: Fri, 26 Aug 2011 20:09:03 +0000

Hi Julien,

>desirability of the inter-system handover scheme in use.

You mean the impact (in terms of lower performance) of handovers across
3GPP and non-3GPP handovers does not really matter because those
applications that rely on high performing handovers will anyway not rely
on such?
But you could make a case that we could see applications (eg. Skype) that
would benefit from lower latency handovers across the different radio
systems.

-Raj

---

From: Julien Laganier <[email-masked]>
Date: Fri, 26 Aug 2011 13:11:34 -0700

Hi Raj,

> applications that rely on high performing handovers will anyway not rely

No I meant that because the MN has different radio systems, it can
turn one on and send a BU while still receiving/sending data via the
old one, and thus MIP handover performance isn't in a critical path in
that situation. For single radio the situation is obviously different.

--julien

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 26 Aug 2011 13:11:31 -0700

Hello Julien,

> desirability of the inter-system handover scheme in use.

It is definitely true that a handset with two different
radio interfaces, given proper infrastructure support and
software, can maintain excellent user experience as the
application session is maintained seamlessly while the handset
changes its care-of address to reflect its new point of
attachment to the Internet from a new radio interface.

Is this what you meant?

But the way in which authentication is carried out during
handovers has a crucial impact on the handover performance.
Do you not agree?

Regards,
Charlie P.

---

From: <[email-masked]>
Date: Fri, 26 Aug 2011 20:14:19 +0000

>that situation. For single radio the situation is obviously different.

Agree. Such a scenario would essentially result in a make-before-break
handover and hence the latency resulting from attach and authentication
would not be as much of a concern. Thx for the clarification.

---

From: Julien Laganier <[email-masked]>
Date: Fri, 26 Aug 2011 13:24:49 -0700

Hello Charlie,

> attachment to the Internet from a new radio interface.

Yes.

> handovers has a crucial impact on the handover performance.

As above, I've been saying that Mobile IP handover performance does
not seem to be a factor in how desirable it is for use in a 3GPP
system.

--julien

---

From: Hesham Soliman <[email-masked]>
Date: Sat, 27 Aug 2011 19:40:58 +1000

FWIW, I agree 100% with Julien.
First, access authentication and HA auth are two completely different
issues for different purposes. Second, I don't think MIPv6 is not deployed
because it adds a one-off SA setup with the HA. I wish that was the
reason. 

Hesham

-----Original Message-----
From: Julien Laganier <[email-masked]>
Date: Thu, 25 Aug 2011 15:39:33 -0700
To: Pete McCann <[email-masked]>
Cc: <[email-masked]>, mext <[email-masked]>
Subject: Re: [MEXT] Well-known problem with authentication/etc. in
wireless networks

---

From: Alexandru Petrescu <[email-masked]>
Date: Sat, 27 Aug 2011 19:17:24 +0200

Le 26/08/2011 00:12, Pete McCann a écrit :
> Hi, Julien,
>
> On Thu, Aug 25, 2011 at 5:02 PM, Julien
> Laganier<[email-masked]>  wrote:
>> Yes, EAP authentication for IKEv2. Yes the MN needs to attach to
>> the network first, as hosts currently do today already.
>
> Right.  I think Charlie was asking whether MIP could be the network
> access authentication protocol.

I read that so too.

I have a side note.

I have a big doubt about making Mobile IP at IETF more attractive to
3GPP, be that in the security domain (EAP, access control) or any other.

Specifying IETF protocol is often backed by significant implementation
effort.  And it is hard to do implementation effort when prerequisite
tools are: (0) licensed spectrum, (1) a SIM card paid subscription, (2)
a real 3GPP Base Station and (3) operator's source code, compared to
implementation effort using cheap WiFi equipment, cheap-free open source
code and unlicensed spectrum.

I fail to see how a better MIP could be designed for 3GPP if a large
number of implementers don't have access to these tools.  Or maybe
speculating, logically extending, behaviour on WiFi to 3GPP - once again.

That is why I doubt an effort to make Mobile IP more attractive to 3GPP
could happen at IETF.

(this is not to say MIP is not good for mobility - it is very good when
handing over from 3GPP link to e.g. WiFi, from one operator to another).

(also, at various points in time I personally did have access to these
tools but no intention could there be to talk at IETF about the inner
workings of these tools, nor to modify them).

Alex

>
>>> It may be interesting to look at whether access authentication
>>> and mobility management can be combined.
>>
> Making initial establishment of the SA with the HA (upon network
> attachment) more efficient.  Making handovers faster and more
> efficient by reducing the number of round-trip messages required.
>
> -Pete _______________________________________________ MEXT mailing
> list [email-masked] https://www.ietf.org/mailman/listinfo/mext
>

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 29 Aug 2011 11:49:41 -0700

Hello Hesham,

On 8/27/2011 2:40 AM, Hesham Soliman wrote:

> First, access authentication and HA auth are two
> completely different issues for different purposes.

That is highly debatable, and I certainly disagree that
they are required to be completely separate.  Moreover,
the authentication often relies on access to the same
authentication server.  Doesn't sound completely separate
to me!  Why is it good to enforce multiple round trips
to bottleneck systems just to ask the same question
multiple times?  Actually, I know the answer:
"That's just how it's done".  Do you _really_ think
that ought to be good enough?

I think these serialized authentications are a major
impediment to good performance, and that proper design
would maintain robust security while enabling much
better performance.  And, to reiterate, I strongly
disagree that tunnel redirection is fundamentally
required to be separated from establishing access
to the wireless media.

Do you agree that we should give up on single-radio?

What about multi-radio devices with N interfaces?
Should we just run all the network interfaces?
Sounds bad to me.

>                   Second, I don't think MIPv6 is not deployed
> because it adds a one-off SA setup with the HA.

The above authentications are not "one-off".  They happen
at every new WiFi network, or more generally at every new
point of attachment to a different radio access technology.
I'm fine with setting up a SA with the home agent, but that's
not the problem.

> I wish that was the reason.

Well, in your opinion what _is_ the reason?

Regards,
Charlie P.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 29 Aug 2011 11:51:20 -0700

Hello Behcet,

On 8/29/2011 11:32 AM, Behcet Sarikaya wrote:

> Folks, let's get back to what was decided in IETF 81 Wednesday morning meeting.

O.K.  Which part do you think we should discuss first?

Regards,
Charlie P.

---

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 31 Aug 2011 08:18:25 -0700 (PDT)

Hi Charlie,
Maybe we are overreacting.
IPv6 has not picked up yet, currently IPv6 traffic seems to be less than 2% of IPv4 traffic. More time is needed for IPv6 deployment which could be followed by IPv6 mobility deployment.

Regards,

Behcet

---

From: "Charles E. Perkins" <[email-masked]>
Date: Wed, 31 Aug 2011 09:40:39 -0700

Hello Behcet,

On 8/31/2011 8:18 AM, Behcet Sarikaya wrote:

> IPv6 has not picked up yet, currently IPv6 traffic seems to be less
> than 2% of IPv4 traffic.

That's less than 0.2%.  It's pitiful.

> More time is needed for IPv6 deployment which could be followed by
> IPv6 mobility deployment.

More time is needed for deployment, but we are
behind on what is needed for standardization.

As I discussed before, unless we provide a credible
alternative, we are looking forward to extraordinarily
complicated and rickety systems (per application!)
(per RAT!) that have high operational expense.
It does not at all bode well for the end-users
(e.g., you and me).

We ought to act ASAP.

Regards,
Charlie P.

---

From: Julien Laganier <[email-masked]>
Date: Wed, 31 Aug 2011 12:11:43 -0700

Hello Charlie,

Mutual authentication between the MN and the HA is only required at
binding creation to set-up the MIPv6 security association that is
keyed with the Home Address; the same security association is then
used to protect further binding updates. Thus there is no
serialization of authentication used for network access and MIPv6.

Whether or not network access authentication has to be repeated at
every attachment to a new network is also not a given. There are a
certain number of optimizations that avoid re-running full network
access authentication procedures.

In any case I would like to note that the issues in that space seems
to be not specific to MIPv6/MEXT and more appropriately belongs to
different fora, e.g., PANA for IETF-specified network access
authentication, the security area for what pertains to authentication
mechanism per se, or the SDO in charge of the specific underlying
technology encountering problem.

Let's try to focus discussions on this mailing lists to what we are
chartered to work on.

Regards,

--julien

---

From: Pete McCann <[email-masked]>
Date: Wed, 31 Aug 2011 19:45:41 -0400

Julien,

> serialization of authentication used for network access and MIPv6.

Many of the DMM proposals seem to contemplate getting a new HA
upon every new attachment to the network.  It seems to me that it
would be in scope to consider optimization of the setup of the security
association with the newly met HA and that this could somehow leverage
the network access authentication that has just taken place.

-Pete