Subject: Re: [Mip6] I-D ACTION:draft-mkhalil-mipv6-nai-00.txt

From: "Akhtar, Haseeb" <[email-masked]>
Date: Wed, 19 Nov 2003 08:16:47 -0800

TJ,

Sorry for the delayed response. Please see my comments below (preceded by HA>>).

Regards,

Haseeb

[email-masked] wrote: 
 > A New Internet-Draft is available from the on-line Internet-Drafts directories. 
 > Title : Mobile IP Network Access Identifier Extension for IPv6
 > Author(s) : M. Khalil, et. al. > Filename : draft-mkhalil-mipv6-nai-00.txt 
 > Pages : 0 
 > Date : 2003-10-17 
 > This document defines a way for the mobile node to identify itself, 
 > by including the NAI with the MIPv6 Binding Update messages. 

I have some comments and questions on the draft, if you're ready for them.

Is there supposed to be any way to authenticate a user as owning a particular
NAI? Are you planning on integrating the use of AAAv6, PANA, or some other
method?

HA>> Yes. The authentication can be done using AAAv6 or any other
HA>> mechanism supported by MIPv6. 

   Upon receiving the Binding Update, the HA will first verify 
   the authenticity of the Binding Update. It will then attempt
   to allocate a unique IP address to the MN.

This is a catch-22, right? How can the HA verify the authenticity of the BU
without having a pre-established security association with the MN at a certain
address? There is no way listed to establish some sort of authenticity of the
NAI, unless I am totally missing something..

HA>> You're right about the catch-22. However, we have sent out a draft
HA>> last week to address this issue (should be showing up in the list
HA>> any day now. The idea is to have the BU message authenticated (ensure
HA>> the message integrity) first and then have the user authenticated.

  Upon receiving a Binding Update, the HA MUST verify the 
  authenticity of the Binding Update message. The authentication
  process is out side the scope of this draft.

I disagree.

  If and when the HA receives a valid Binding Update with the
  Home IP address field set to zero and the NAI option included,
  it will attempt to allocate a unique IP address and 
  proceed with registration procedure as stated in [MIPV6].

So this means you are turning off all security?

HA>> We are in the process of updating this draft so that it reads better
HA>> as well as address your concerns. Stay tuned for the next version.

I think I am not understanding the gist of the draft. Please explain how
security works in this scheme..

thanks,

TJ

HA>> Thanks for your comments as well.

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6