Subject: RE: [Mip6] New Draft with Bootstrapping Protocol

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 6 Dec 2004 19:03:17 +0100

hi james, 

~snip~

> >
> 
> Yes, that's the idea. Most hotspots today in the US and some 
> I've used in Europe and Japan don't use EAP. Also, there's 
> the enterprise and nonintegrated mobility service provider 
> examples. You'll recall that we discussed the nonintegrated 
> case in the problem statement design team. An EAP on network 
> entry bootstrapping approach won't work for that case.

that's certainly true and also true for network access scenarios. the
drawbacks of these approaches are also known. i am, however, not quite sure
what you would like to standardize in this case. 

ciao
hannes

>             jak

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "James Kempf" <[email-masked]>
Date: Mon, 6 Dec 2004 10:22:20 -0800

> what you would like to standardize in this case.

A specified, interoperable way of doing HA configuration without AAA would,
I think, be useful. As you mention, most of the rest can be handled by
IKEv2. Perhaps actually writing down how to use IKEv2 for bootstrapping in
this context would also be useful as an example, since the IKEv2 spec is 108
pages long, and Vijay's draft probably shouldn't go into bootstrapping in
detail, since it needs to be applicable to both cases.

            jak

---

From: Marc Manthey <[email-masked]>
Date: Mon, 6 Dec 2004 20:10:36 +0100

>>> entry bootstrapping approach won't work for that case.

IMHO the idea that ipv6 could reach millions of peoople could
cause a lack of traffic to normal phone companys this is
the problem what we have in germany. There is always a "last mile"
and the costs for umts, gprs,hdscd is enormous cause of the
billions what the "lizense" of UMTS cost for all the providers.
So what could happen when there is a protokol that connects
all hotspots ?
You can´t even acces one hotspot in germany whitout having
a telekom account.!!! is that monopoly?
true or false?
cheers
marc
-- 
Build a man a fire, and he'll be warm for a day.
Set a man on fire, and he'll be warm for the rest of his life.

          http://let.de

---

From: "James Kempf" <[email-masked]>
Date: Mon, 6 Dec 2004 14:44:01 -0800

> a telekom account.!!! is that monopoly?

Hmm, well, it certainly wasn't our intention to put Deutsche Telecom out of
business by publishing this document.

In any event, I think this isn't the right mailing list for this kind of
discussion, perhaps better on the ietf mailing list.

            jak

---

From: "Junghoon Jee" <[email-masked]>
Date: Tue, 7 Dec 2004 16:04:12 +0900

Hi ! James,

As I already said in this MIP6 mailing-list thorough review of draft-ietf-mip6-bootstrap-ps-01.txt,
I think we have to decide what scenario our MIP6 bootstrapping solution should support.

I havea question about this.

Does our bootstrapping solution should consider infrastructure-less scenario or not ?

For your convinence,
I attach my review of draft-ietf-mip6-bootstrap-ps-01.txt.
This can be helpful for our discussion.
----------------------------------------------------------------------------------------------
Q1. Should the network access service be always performed when a MN bootstraps ? 

Section 6.  Network Access and Mobility services
[Page 14]
Only having Mobile IPv6 service is not possible, since the Mobile IPv6 protocol requires
ability to send and receive IPv6 packets.  
=> It seems that network authentication service should be always performed.

Section 7.1  Mobility Service Subscription Scenario
=> There is no words about network authentication service.

Q2. Does we have to consider the case of  infrastructure-less scenario 
when we develop a bootstrapping solution or not ?

Section 7.4 Infrastructure-less scenario
[Page 17]
This specific scenario is not supported in this document.  The reason
for this is described in Section 9.

Section 9. Security Considerations
Thus, the case of infrastructure-less network where there is absolutely 
no pre-mediated trust is kept outside of scope of this document.

=> It seems that we don't need to consider the infrastructure-less scenario 
     when we create a bootstrapping solution.
-----------------------------------------------------------------------------------------

Junghoon

---

From: "James Kempf" <[email-masked]>
Date: Tue, 7 Dec 2004 08:56:09 -0800

Hi Junghoon,

I believe we agreed on the problem statement design team that the solution
did not have to support an infrastructureless scenerio. The expectation in
RFC 3775 is that the mobile terminal will have a prior relationship with the
network provider hosting the home agent, in order that the terminal can be
properly authenticated prior to establishing the IPsec security association
(at the latest).

In draft-chakrabarti-mip6-bmip-00.txt, the terminal is authenticated via an
EAP transaction conducted as part of the IKEv2 exchange with the home agent
to set up the IPsec SA. The home agent needs to have access to the
terminal's previously recorded subscription information, this could be
accomplished via an AAA back end transaction, as Alper pointed out, or by
other means, perhaps a local database for a small mobility service provider
(note: when the draft speaks about supporting network access when AAA is not
used, it is only talking about the mobile terminal/access network to home
network connection, not the back end in the home network).

As for the need for IP service to provide Mobile IP service, one could say
this about any IP-based service. I don't think it is an argument for always
bundling network access and mobility service access. We discussed this
extensively in the problem statement design team and decided that the
separate network and mobility service provider case constituted a legitimate
scenerio under RFC 3775 that we believed the bootstrapping solution should
support.

            jak

----- Original Message ----- 
From: "Junghoon Jee" <[email-masked]>
To: "James Kempf" <[email-masked]>; "Tschofenig Hannes"
<[email-masked]>; <[email-masked]>
Sent: Monday, December 06, 2004 11:04 PM
Subject: Re: [Mip6] New Draft with Bootstrapping Protocol

---

From: "Junghoon Jee" <[email-masked]>
Date: Wed, 8 Dec 2004 11:51:40 +0900

Hi James,
Plz see comments inline.

----- Original Message ----- 
From: "James Kempf" <[email-masked]>
To: "Junghoon Jee" <[email-masked]>; "Tschofenig Hannes" <[email-masked]>; <[email-masked]>
Sent: Wednesday, December 08, 2004 1:56 AM
Subject: Re: [Mip6] New Draft with Bootstrapping Protocol

> did not have to support an infrastructureless scenerio. 

Thank you for answering my question. 
If the bootstrapping solution need not support the infrastructure-less scenario, why does your approach, 
draft-chakrabarti-mip6-bmip-00.txt emphasize the pros. of it by mentioning that you don't need AAA infrastructure ?
Regarding your abstract, 
Though you say that your mechanism is applicable in general at the end of the abstract, 
after reading all of abstarct section, i conclude that your mechanism has a benefit of
supporting MIP6 bootstrapping without need of AAA infrastructure. 

Anyway, I think MIP6 bootstrapping solution need a 3rd party trusted entity, because
bootstrapping information is a very sensitve information that should be protected.
I think that adopting AAA server as a trusted entity to support MIP6 bootstrapping is a right choice.

> The expectation in RFC 3775 is that the mobile terminal will have a prior relationship with the

> scenerio under RFC 3775 that we believed the bootstrapping solution should

Could you give me information about discussions and the decision of the problem statement design team ?

In my opinion, the Mobile IP service is an IP-based service. So only authenticated and authorizaed
MN can access the network and can use the Mobile IP service. 
If we decouple the network access service from mobility serivice, unauthorized MN can access the visited domain's network.

Related with this, draft-ietf-mip6-bootstrap-ps-01.txt has a following statement.
Section 6.  Network Access and Mobility services
[Page 14]
Only having Mobile IPv6 service is not possible, since the Mobile IPv6 protocol requires ability to send and receive IPv6 packets.

Junghoon

---

From: "James Kempf" <[email-masked]>
Date: Wed, 8 Dec 2004 08:44:15 -0800

Junghoon,

> I think that adopting AAA server as a trusted entity to support MIP6
bootstrapping is a right choice.

My interpretation of "infrastructure" here, based on my memory of the design
team discussion, is different from yours. I don't believe the design team
and problem statement draft meant to confine the solution to a scenario
where AAA is required between the host and the access network for initial
network access. This would shut out 90% of the worldwide hotspot service
providers, who today use UAM for access, from using bootstrapping for Mobile
IPv6, to say nothing of the many enterprise and small business network
providers who don't use AAA for network access. I believe infrastructure
refers to back end infrastructure, defined as a mechanisms for verifying a
pre-existing subscriber relationship between the network operator owning the
HA and the owner of the terminal, which could include backend AAA between
the HA and the subscriber database. The solution outlined in
draft-chakrabarti requires some kind of subscriber relationship in order for
the EAPoIKEv2 transaction to complete. In that sense, it satisfies the
requirement for backend infrastructure. Perhaps we need to be more specific
in the draft about what is meant by not requiring AAA.

But your comments do raise another interesting point. Is the problem
statement draft specific enough on this point, or does it need some
modification to make this clearer? What do other people think?

> If we decouple the network access service from mobility serivice,
unauthorized MN can access the visited domain's network.
> Only having Mobile IPv6 service is not possible, since the Mobile IPv6
protocol requires ability to send and receive IPv6 packets.

In draft-chakrabarti, a mobile terminal must have credentials preconfigured
so that it can complete a EAPoIKEv2 transaction with the HA. The HA uses the
credentials to authenticate the mobile terminal against the subscriber
database, and to determine whether the mobile terminal is authorized for
mobility service.

It is entirely possible that a mobile terminal may be authorized for network
access but not for mobility service. In such a case, an attempt by the
mobile terminal to obtain initial network access will succeed, but an
attempt to complete the IKEv2 transaction with the HA will fail and the
mobile terminal will be unable to obtain mobility service. The reverse
case - where the mobile terminal fails to obtain network access due to lack
of authorization but achieves authorization for mobility service - is not
possible, since, as you point out, the terminal must have IP service in
order to achieve Mobile IP service. Thus, it is not possible for an
unauthorized terminal to obtain mobility service, or network access service.

            jak

---

From: "Junghoon Jee" <[email-masked]>
Date: Thu, 9 Dec 2004 09:59:23 +0900

Hi !, James
 
> network access.

If AAA is not used to provide a MN with the network access service,
is there any other standardized or popular way to do this ?
 
>This would shut out 90% of the worldwide hotspot service
> the HA and the subscriber database. 

We need to define clearly the word, 'infrastureless'.
If we think about a DIAMETER infrastructure, DIAMETER servers are located in the vistited domain and
home domain of MN.
We cannot operate DIAMETER only with home domain's DIAMETER server.
In the visited domain, DIAMETER clients are also required which may be co-located with a AR/Attendant which
controls the terminal's network access.

> modification to make this clearer? What do other people think?

As you know, I already sent some comments about the problem statement document,
I don't know the current status of it.
I think that some modification of it is required to make it clearer.
 
> unauthorized terminal to obtain mobility service, or network access service.

Right, 
If the network access service should be always performed before or simultaneously with mobility service,
is the initial network access service for a bootstrapping MN required or not ?

Junghoon

---

From: "James Kempf" <[email-masked]>
Date: Thu, 9 Dec 2004 07:14:21 -0800

> is there any other standardized or popular way to do this ?

See http://www.wifialliance.org/opensection/downloads/wispr_v1.0.pdf. This
is used by most hotspot service providers.

> is the initial network access service for a bootstrapping MN required or
not ?

The MN must have network access to achieve mobility service access. But
authorization for the two does not have to be coupled.

        jak