Subject: [Mip6] Draft on Securing Home Agent List

From: Sachin <[email-masked]>
Date: Mon, 11 Jul 2005 04:38:27 -0700

Dear MIP6 Group
 
We have submitted a new internet draft for securing home agent list in
Mobile IPV6. A URL for this Internet-Draft is:
 
http://www.ietf.org/internet-drafts/draft-dutta-mip6-ra-00.txt

Technical Summary:
The home agent list is learnt by receiving the RA messages. So
any rogue node on the link can send spurious RA on behalf of non
existent nodes. This results in non-reachable and non-existent entries
in the home agent list causing delay in getting service for a MN or not
getting service at all.

We are looking forward for your feedback. Thanks in advance for your
kind consideration. 
 
Best Regards

Mao Shanxiang , Suraj , Deshbandhu &  Sachin 
(Authors)

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Radhakrishnan.S" <[email-masked]>
Date: Mon, 11 Jul 2005 18:40:55 +0530

Hi,
      This draft has brought out an interesting problem. SEND could help 
solve this problem. So why this method??????

Anyway, i am posting few comments i have:
(1) I feel the use of STALE and REACHABLE in places referring to states in 
both HA List and NCE is little confusing. Maybe use of different words like 
VALID/INVALID to indicate state of an entry in HA List would be better.

(2) Sec 3.1
     " o If the entry exists and it state is STALE then simply ignore
        this RA message."
-> Only if RA parameters are identically same with prev one, isnt it?

(3)  In section 3.1
-> What about RAs with global address as source address????

(4)  In section 3.4
"      o In case the DHAAD reply message becomes more then PMTU then HA
        must include self Home Agent address. This will ensure at least
        one valid reachable home agent address"
-> Very good thought. I feel making it mandatory for the HA to carry its 
address in HA list in DHAAD reply irrespective of message size will 
guarantee atleast one valid reachable HA. :-)

(5) What happens in case of a node replying with bogus NA when HA sends 
NS??? SEND can help in such a case. maybe security considerations section 
needs to be updated for such a scenario.

(6) There are grammatical errors at quite few places and missing 
punctuations.

Regards
Radhakrishnan
----- Original Message ----- 
From: "Sachin" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>; 
<[email-masked]>
Sent: Monday, July 11, 2005 5:08 PM
Subject: [Mip6] Draft on Securing Home Agent List

---

From: "James Kempf" <[email-masked]>
Date: Mon, 11 Jul 2005 14:16:23 -0700

So if the Home Agent list is built up from RAs, why can't RFC 3791  be used
for security?

            jak

----- Original Message -----
From: "Sachin" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Monday, July 11, 2005 4:38 AM
Subject: [Mip6] Draft on Securing Home Agent List

---

From: "Radhakrishnan.S" <[email-masked]>
Date: Tue, 12 Jul 2005 09:41:28 +0530

Jak,
  you mean RFC 3971????

----- Original Message ----- 
From: "James Kempf" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>; 
<[email-masked]>; <[email-masked]>
Sent: Tuesday, July 12, 2005 2:46 AM
Subject: Re: [Mip6] Draft on Securing Home Agent List

---

From: "James Kempf" <[email-masked]>
Date: Tue, 12 Jul 2005 09:59:36 -0700

Yes, sorry.

            jak

----- Original Message -----
From: "Radhakrishnan.S" <[email-masked]>
To: "James Kempf" <[email-masked]>; <[email-masked]>;
<[email-masked]>; <[email-masked]>; <[email-masked]>;
<[email-masked]>
Sent: Monday, July 11, 2005 9:11 PM
Subject: Re: [Mip6] Draft on Securing Home Agent List