Subject: RE: [Mip6] Bootstrapping on the home link

From: "Soliman, Hesham" <[email-masked]>
Date: Mon, 24 Apr 2006 10:00:09 -0700

> > See RFC 4033. Section 9.1 in the bootstrapping draft discusses the 
 > > security considerations for DNS in bootstrapping.
 > 
 > I read it.  I'm left with the impression that DNS querying in the
 > visited domain can't be guaranteed secure because all DNS 
 > Servers aren't
 > known to be secure.
 > 
 > Knowing this, do you agree that the entire argument claiming 
 > DHAAD is 
 > not good because it is insecure applies to DNS HA discovery as well?

=> Of course. Both insecurities amount to a DoS attack, which will
not hijack any sessions, but will stop the MN from being 
reachable. But the real advantage of using the DNS is not security, 
it's the ability to not store IP addresses/prefixes in the 
MN, which allows it to be more resilient to network changes like 
renumbering. 

Hesham

 > 
 > Alex
 > 
 > 
 > _______________________________________________
 > Mip6 mailing list
 > [email-masked]
 > https://www1.ietf.org/mailman/listinfo/mip6
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 24 Apr 2006 19:19:47 +0200

Soliman, Hesham wrote:
> 
>>> See RFC 4033. Section 9.1 in the bootstrapping draft discusses
>>> the security considerations for DNS in bootstrapping.
>> 
>> visited domain can't be guaranteed secure because all DNS Servers
>> aren't known to be secure.
>> 
>> Knowing this, do you agree that the entire argument claiming DHAAD
>> is not good because it is insecure applies to DNS HA discovery as
>> well?
> 
> not hijack any sessions, but will stop the MN from being reachable.

Your affirmation is true _if_ the MN stores certs.  If it does, then the 
amount of preconfigured info is much larger than with DHAAD.  A simple 
method based on DHAAD would only store shared keys (not certs).

> But the real advantage of using the DNS is not security, it's the
> ability to not store IP addresses/prefixes in the MN, which allows it
> to be more resilient to network changes like renumbering.

1. MPD is designed just for that - face home link re-numbering.

2. nowhere in the draft it's said the advantage of the DNS-based HA
    discovery is it's resilient to renumbering.

3. DHAAD use doesn't preclude the use of HA names in the DNS.  What
    DHAAD is less resilient to is when the entire home prefix gets
    changed.  In which case so many things will change that I guess the
    certs on the MN are no longer valid either - how do you update certs
    on the MN?

Alex

> 
> Hesham
> 
>> 
>> Alex
>> 
>> 
>> _______________________________________________ Mip6 mailing list 
>> [email-masked] https://www1.ietf.org/mailman/listinfo/mip6
>>

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 24 Apr 2006 19:22:45 +0200

Soliman, Hesham wrote:
> MN,

For SVR, it's little possible to just store _mip6._ip6.domain.com in the 
MN because the reply back doesn't tell the MN the HA where the MN was 
attached when it was at home (there can be several subnets in 
domain.com, and each MUST have at least a HA).

Alex