Subject: Re: [Mip6] comments on chakrabarti-mip6-bmip

From: Samita Chakrabarti <[email-masked]>
Date: Tue, 11 Jan 2005 16:10:35 -0800 (PST)

> > I think that we could have 2 solutions for bootstrapping Mobile IPv6:
> >
> >  - one based on AAA infrastructure
> >
> >  - one that could be used without AAA
> 

That's the idea of bmip draft. Although one could use non-AAA
mechanism for boot-strapping for business reason and then HA
may independently work with AAA server for accounting purpose.

-Samita

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Junghoon Jee" <[email-masked]>
Date: Thu, 13 Jan 2005 11:57:16 +0900

Hello, Samita and ALL.

I have one question about your bmip draft.
In your draft, HA discovery is performed by looking up the DNS server.
Do you have any idea about securing that process ?

The draft-ietf-mip6-bootstrap-ps draft says about the securing 
the bootstrapping configuration information.

[Page 7]
3. Design Goals
  o  Configuration information which is exchanged between the mobile
      node and the home agent must be secured using integrity and replay
      protection.  Confidentiality protection SHOULD be provided if
      necessary.

I think that the configuration information includes the HA address.

Regards,

Junghoon

---

From: "James Kempf" <[email-masked]>
Date: Thu, 13 Jan 2005 14:55:10 -0800

Junghoon,

Samita provided you with a response on this, but I think there are  yet a

> I think that the configuration information includes the HA address.

The operative words here are "SHOULD be provided if necessary".

Some mobility service providers may have a business model in which
confidentiality protection is explicitly not necessary. For example, both
Yahoo and my employer provider me with email service. The address of Yahoo's
email server is in the public DNS, but the address of my employer's is not,
I can only access it over the corporate VPN. The reason is because the
business models for email service are quite different. Similarly, it is
possible for a mobility service provider to have a business model which
explicitly requires that the HA address be publicly available, as is the
case for Yahoo's email server.

In addition, I think we need to be clear about what level of confidentiality
is possible and desirable. Considering the EAP solution defined in
draft-giaretta-mip6-authorization-eap-02.txt, the AAA server in the home
network of the integrated mobility and network service provider configures
the home agent address to currently subscribed customers when they request
network access. At that point, the address has effectively been revealed to
the customer. Now, if a customer's account is later revoked, they still have
access to the address, and can launch a DoS attack on it (I believe DoS is
the major security concern here) or pass the address along to a third party
who can. In order to remove that risk, the intergrated mobility and network
service provider must periodically renumber their HAs after a certain number
of accounts have been revoked, or after an account has been revoked from a
customer who the service provider has reason to suspect might cause trouble.
It certainly would be quite useful if renumbering was not required, but I
have some amount of difficulty seeing how to avoid this (in fact, I think
given the basic Mobile IP architecture, it is impossible to avoid).

We're working on a solution with a similar level of security for DNS based
HA address discovery. As I mentioned above, it should not be required in all
cases, because some mobility service providers might explicitly want
publicly accessable HA addresses, but it should be available if needed, as
the problem statement indicates.

            jak

---

From: "Junghoon Jee" <[email-masked]>
Date: Fri, 14 Jan 2005 18:05:27 +0900

Hello, James

Please see my comments inline.
 
> The operative words here are "SHOULD be provided if necessary".

What about the phrase related with the integrity and replay protection ?
Isn't it operative words ?

Does your working solution cover the integrity and replay protection ?

> case for Yahoo's email server.

I am not sure whether the relationship between the MN and its HA is
similar to the email client and public email server.
The stability and protection of HA is very critcal in the operation of MIP service.

> who can. 

Who are 'they' in the above ?
Are they customer of MIPv6 service using mobile terminal ?
IMHO, it is possible to operate MIPv6 service not revealing the HA address to 
the ordinary mobile terminal user.
If they are hackers who can hack the mobile terminal and can gain a access the configured HA address, 
this is another problem that can be dealt in the system security part. 
I think we are dealing this security issue related with network securty problem
which can be arisen during transfering the critical informatin over the network.

BTW, i don't have clear understaning about the effitiveness of protecting the HA address during bootstrapping.
The HA address can be reveled at any time by anyone who can sniff the network.

Regards,
Junghoon

---

From: "James Kempf" <[email-masked]>
Date: Fri, 14 Jan 2005 09:07:30 -0800

> Does your working solution cover the integrity and replay protection ?

It will be discussed in the draft.

> The stability and protection of HA is very critcal in the operation of MIP
service.

Different business models may provide different levels of guarantees for
stability and protection. If I'm running a standard telcom voice + data
service provider, I might want to provide rock solid guarantees that the
mobility service is five 9's reliable. Of course, I would probably also
charge for that kind of reliablity. On the other hand, if I'm running a low
cost public access mobility service, maybe I can get by with four 9's or
even three. Any solution to HA bootstrapping that picks and chooses one
business model over the other should be avoided. Please see RFC 3724 for a
discussion of tussles in Internet standardization and the need for
maintaining a neutral playing field.

That said, I must say that I've never experienced a problem with stability
and protection in Yahoo mail in the over five years I've used it, except at
the very beginning. They've never dropped any of my archived mail, and
although the service has been occasionally unreachable due to maintenance,
I've been quite satisfied with it, especially considering what I pay for it,
which is nothing. There were some problems with reachability in the early
years, but they seem to have gotten the problems straightened out. I don't
use the service for business-critical email, however, that's what my
corporate account is for.

> Who are 'they' in the above ?

The customer whose account has been revoked.

> Are they customer of MIPv6 service using mobile terminal ?

They were a customer until their account is revoked. After that, they are no
longer, but because they've seen the HA address in the past, they could
still potentially cause trouble unless the HA address is changed.

Note that this same problem occurs for the RFC 3775 default manual
configuration, in fact, in that case it's even worse because the mobility
service provider has no way to change the HA address on its customers'
terminals except to somehow contact each one individually by some undefined
means. For EAP boostrapping, the terminal can re-run the network access
procedure and obtain a new HA address, and for DNS bootstrapping, the
terminal can reaquire the address from the DNS. I don't recall if the
problem statement design team addressed this issue, but I believe we didn't.

> which can be arisen during transfering the critical informatin over the
network.

The only way I can think of to do this is to use some kind of indirection
like Ian Stocia's I3 or Pekka Nikkander and Jari Arkko's HI3. These
proposals are research projects (and they've also got a lot of problems from
the deployability and performance standpont), and therefore not yet
appropriate for consideration as standards. It's also possible to use
indirection via DNS or other network management mechanisms, that's how Web
service providers and the public DNS servers themselves deal with fending
off DoS attacks, but if you've got some way to do this that would involve
standard mechanisms or using default RFC 3775 mechanisms different from
these approaches, I'd certainly be interested in hearing it.

> The HA address can be reveled at any time by anyone who can sniff the
network.

Snooping the HA address on, say, BUs  which are sent in the clear (provided
the HA doesn't require an encrypted ESP tunnel for them to prevent such
snooping) requires that the attacker can launch a MiTM attack. MiTM attacks
are relatively rare in the Internet, in fact, I don't know of any that have
been successfully launched (if anybody knows, I'd like to hear about it),
and IPv6 has even stronger mechanisms to protect mechanisms vulnerable to
MiTM than IPv4. While it is certainly worthwhile protecting against MiTM if
the cost is not excessive, it is even more important to protect against
offpath attacks. Publishing an address in the public DNS makes the node
vulnerable because anybody can get the address and launch a DoS attack. Most
providers of public access services such as Web servers or even DNS itself
have derived network management mechanisms to deal with these attacks, as
there have been a variety of well-publicized attacks over the last few
years, but I believe it is worthwhile looking at other mechanisms that deal
with the threat directly, and that's what the solution we're working on is
intended to do.

                    jak

---

From: "Junghoon Jee" <[email-masked]>
Date: Sat, 15 Jan 2005 03:31:52 +0900

Hello James,

> It will be discussed in the draft.

Okay, I would like to know that you're touching this point.

> corporate account is for.

My view point about the difference between the MIP service and the email service is like this;
If a MN can not reach to its HA, the MN cannot receive all of the IP service through that HA.
On the other hand, if the MN can not reach to the specific email server, it cannot check and
possibly lose its email only throgh that server. Other Internet application services are still possible.

> problem statement design team addressed this issue, but I believe we didn't.

I think that it may be related with the privacy issues.
And i would like to know your position about this issue.
Do you think that we SHOUD guarantee the confidentiality protection of the HA address ?
I'd say that the confidentiality protection is not only related with the bootstrapping but also 
related with the normal MIPv6 operation.

> snooping) requires that the attacker can launch a MiTM attack. 

I'm sorry but I don't have clear understanding what you're saying about.
"Snooping the HA address requires that the attacker can launch a MiTM attack." ?
I am not concerning about the MiTM attack with regard to the MIPv6 bootstrapping.

> Most providers of public access services such as Web servers or even DNS itself

It is interesting. Are you planning on touching this in your future I-D ?
But, i think it is not only related with bootstrapping.

--Junghoon.

---

From: "James Kempf" <[email-masked]>
Date: Fri, 14 Jan 2005 13:17:20 -0800

> possibly lose its email only throgh that server. Other Internet
application services are still possible.

If the MN loses its HA for any reason, it loses the ability to move from one
subnet to another, i.e., it loses mobility service. It does not lose the
ability to send and receive traffic from the Internet, since it can use its
care-of address for that. Hotspot service today works fine without Mobile IP
as long as you don't want to move from one subnet to another.

On the other hand, if the network service provider's AAA server is disabled,
the MN does lose the ability to gain Internet access. What happens if the MN
already has Internet access and the AAA server is disabled depends on how
the accounting records are handled. I think most access network service
providers would probably cut off the MN if they can't send accounting
records back to the home network service provider.

> related with the normal MIPv6 operation.

Actually, I don't see any way, technically, that one can hide the HA address
as the tunnel endpoint on tunneled traffic between the MN and HA. It's like
an IPsec gateway in that respect. Like I said, since the only way the HA
address can be revealed in normal MIP traffic is via a MiTM attack, I don't
see any reason to do anything special to protect it, since MiTM attacks are
relatively rare.

> But, i think it is not only related with bootstrapping.

It's only related to bootstrapping.

            jak

---

From: "Junghoon Jee" <[email-masked]>
Date: Sat, 15 Jan 2005 14:38:50 +0900

Hello James,

> as long as you don't want to move from one subnet to another.

Right, as you said, the terminal can not function as a Mobile Node.
That means that the user who uses the MN cannot receive the service as he registered and paid for this.
As you said, a user cannot move from one subnet to another maintaing his on-going application session.
I don't think that losing the MIP service can be comparable to losing only one application service.

Anyway, I have a question about your approach.
If my understaning is right, you're trying to support MIPv6 bootstrapping when only the MSP is available.
Does your MSP operate the AAA server or not ?
If it does, I think that using the AAAh server to assign the HA is more simpler and secure than using DNS server.
If it does not, how is your MSP composed of ? 

Another point, we had a little bit discussion about the meaning of 'Infrastructure'.
Do you think that the 'Infrastructure' is not based on AAA ?

> records back to the home network service provider.

Right, but normally AAA server is managed more securely and stably than DNS server.

> Like I said, since the only way the HA address can be revealed in normal MIP traffic is via a MiTM attack, I don't

I don't exactly understand about this point.
Hmm, we are looping.
We can easily get the MN's HA address by simply sniffing the MIPv6 signaling message.
Do you imply that sniffing the MIPv6 signaling packet can only be occurred by the attacker
who is in the middle of MN and HA. So are you using the terminology of MiTM ? 

--Junghoon

---

From: "Junghoon Jee" <[email-masked]>
Date: Sun, 16 Jan 2005 01:58:36 +0900

> records back to the home network service provider.

Right, IMHO same situation can be occurred by the MSP using AAA.
AAAv would not allow the new roaming MN to access the network 
if the MN is not authenticated and authorized user which is determined by
contacting the MN's AAAh server.
In this situation, the mobility service is very tightly coupled with the network access service.
Basically, I agree with you that a MN needs to bootstrap where there is no network access control
like most Hotspot network today.
But thinking about AAA operation, it not likely to easy to decouple the network access service
from the mobility service.

--Junghoon

---

From: "James Kempf" <[email-masked]>
Date: Mon, 17 Jan 2005 13:55:57 -0800

> I don't think that losing the MIP service can be comparable to losing only
one application service.

I think we will have to agree to disagree on this point.

> Does your MSP operate the AAA server or not ?

It doesn't have to, but it could if EAP is used in IKEv2 auth. I believe
this was covered on an earlier email in this thread.

> If it does, I think that using the AAAh server to assign the HA is more
simpler and secure than using DNS server.
> If it does not, how is your MSP composed of ?

I think we are looping on this point too. If the MSP is not integrated,
there is no opportunity for AAA prior to the IKEv2 transaction, and that
requires the home address. This was covered earlier in te thread.

> Do you think that the 'Infrastructure' is not based on AAA ?

This point has also been covered. I think most people would agree that DNS
is infrastructure and draft-chakrabarti is based on DNS.

> Right, but normally AAA server is managed more securely and stably than
DNS server.

Again, I think we will have to agree to disagree. DNS is a vital service for
the Internet, and if it is not available, many operations don't work. I
don't see much difference in the incentives for an operator to manage the
two kinds of service.

> > Like I said, since the only way the HA address can be revealed in normal
MIP traffic is via a MiTM attack, I don't
> who is in the middle of MN and HA. So are you using the terminology of
MiTM ?

That was my point.

            jak

---

From: "Junghoon Jee" <[email-masked]>
Date: Tue, 18 Jan 2005 13:58:41 +0900

> I think we will have to agree to disagree on this point.

I know your opinion, but mine is different with yours.
I don't agree with you.

> this was covered on an earlier email in this thread.

I think that you're talking about the Alper's approach as shown below.

      Mobile <---------------> Home agent/ <--------------> AAA
      node      Mobile IPv6,      AAA client     EAP/RADIUS    server
                    EAP/IKEv2

But as I know, it is not yet fully covered in the email thread.
Your reply about the Alper's comments.
"We'll try to incorporate them on the next draft."
My point is that,
If your MSP operate the AAA home server, there is also a AAA local server and 
AAA client which normally performs network access control for the MN at the visted network.

If you don't use AAA server, how would you process the authentication, authorization and 
accounting function for the MN ?

> requires the home address. This was covered earlier in te thread.

If the AAA based MSP is involved, i belive it should be first performed by AAA for network access control.
Does this issue is clearly solved ?
I think it is not yet clear covered.
Plase give me a pointer if i am missing...
 
> is infrastructure and draft-chakrabarti is based on DNS.

I don't think so.
If we would like to choose DNS for MIP6 bootstrapping, 
many issues should cleary be solved like security, safety and stability.
Before that, I am not sure the use of DNS is appropriate for MIP6 bootstrapping.
IMHO, it is not a problem whether the DNS is infrastructure or not 
but a problem whether the use of DNS is appropriate for MIP6 bootstrapping or not.

> don't see much difference in the incentives for an operator to manage the

If DNS is not available, only the DNS query based application service is not available.
Still plain IP service is possible.

Another point, 
In your approach, DNS supports the management of HA lists of a MN.
All the MNs should first contact the pre-configured DNS server to get HA lists.
As I know, the dynamic assignment of HA is owing to load-balancing and operation flexibility.
So we are considering it in our MIP6 bootstapping solution.
But your approach requires the pre-configured DNS to get a dynamic HA.
Following your approach, all the MN should have a pre-configured DNS server address, Right ?

--Junghoon