Subject: [Mip4] FW: MIP4 generic notification draft update

From: "DENG, HUI -HCHBJ" <[email-masked]>
Date: Tue, 19 Jun 2007 15:19:37 +0800

Hello, all

Vijay and Henrik remind me that we could post the discussion to the mailing list 

There is one thing which needs more comments from WG is about whether 
a field of subtype need to be specified or not.

Thanks,

-Hui

> One more thing, similar to mobile header message in MIP6,
> Do we need add subtype in our message in case future other applications.

I don't agree with the changes for generic mobility header signaling message for MIPv6. For the MIPv4 draft, new/future applications can use extensions to indicate what is carried inside the notification message.

> --------------------------------------------
> 6.  Security Considerations
> 
>    This specification operates in the security constraints and
>    requirements of [RFC3344].  It extends the operations of mobile node,
>    home agent and foreign agent defined in [RFC3344] to notifiy each
>    other about some events and provides the same level of security for
>    all three nodes. Whatever this generic notification message carries,
>    , it is crucial that all security and replay protection mechanisms 
>    must be verified.

Re-phrase as

  This specification operates in the security constraints and
  requirements of [RFC3344].  It extends the operations of mobile node,
  home agent and foreign agent defined in [RFC3344] to notify each
  other about some events.  The Generic Notification message defined
  in the specification could carry information that modifies the
  mobility bindings.  Therefore the message MUST be integrity
  protected.  Replay protection MUST also be guaranteed.

>    RFC 3344 [1] defines a security mechanism that MUST be used between
>    home agents and mobile nodes, and MAY used between home agents and
>    foreign agents, and between foreign agents and mobile nodes. 
>    In this specificaiton, all mobile nodes, foreign and home agents MUST 
>    support protection of generic notification messages via the foreign-home, 
>    foreign-mobile, home-mobile authentication extentions defined in 
> [1].

>    Since [1] doesn't provide a replay mechanism for the foreign agent to use, 
>    and this leaves the foreign agent open to a potential denial of service attack, 
>    In this specification, by using a 64-bit Identification it can be
>    more quickly determined whether generic notification messages are 
> replays or not.

Re-phrase as

  RFC 3344 provides replay protection only for registration requests
  sent by the mobile node.  There is no mechanism for replay
  protection for messages initiated by a Foreign Agent. The 64-bit
  Identification field specified in this document for the Generic
  Notification message is used to provide replay protection for the
  notification messages initiated by the Foreign Agent.

Vijay
Disclaimer:
The contents of this e-mail, and its attachments, if any, are confidential and may be protected
by law against any unauthorized use.  If you have received this e-mail by mistake or have
reason to believe that you are not the intended recipient, please notify the sender by reply
e-mail as soon as possible and delete it from your computer system immediately thereafter.
If you are not the intended recipient, you must not copy this e-mail or attachment or disclose
the contents to any other person.  While we have made every effort to keep our network virus free,
we take no responsibility for any computer virus which might be transferred by way of this e-mail.

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/