Subject: RE: [Mip6] Bootstrapping on the home link

From: "Soliman, Hesham" <[email-masked]>
Date: Mon, 24 Apr 2006 10:39:16 -0700

> > => Of course. Both insecurities amount to a DoS attack, which will 
 > > not hijack any sessions, but will stop the MN from being reachable.
 > 
 > Your affirmation is true _if_ the MN stores certs.  If it 
 > does, then the 
 > amount of preconfigured info is much larger than with DHAAD. 

=> I wasn't referring to the amount of information stored, I was talking
about the type of information.

 >  A simple 
 > method based on DHAAD would only store shared keys (not certs).

=> No, there is no relationship between the two.

 > 
 > > But the real advantage of using the DNS is not security, it's the
 > > ability to not store IP addresses/prefixes in the MN, 
 > which allows it
 > > to be more resilient to network changes like renumbering.
 > 
 > 1. MPD is designed just for that - face home link re-numbering.
 > 
 > 2. nowhere in the draft it's said the advantage of the DNS-based HA
 >     discovery is it's resilient to renumbering.
 > 
 > 3. DHAAD use doesn't preclude the use of HA names in the DNS.  What
 >     DHAAD is less resilient to is when the entire home prefix gets
 >     changed. 

=> That *is* renumbering...

   In which case so many things will change that 
 > I guess the
 >     certs on the MN are no longer valid either - 

=> Why not? Certs are not tied to addresses unless you make them
so, but you shouldn't.

  how do you 
 > update certs
 >     on the MN?

=> You don't need to. 

Hesham

 > 
 > Alex
 > 
 > > 
 > > Hesham
 > > 
 > >> 
 > >> Alex
 > >> 
 > >> 
 > >> _______________________________________________ Mip6 mailing list 
 > >> [email-masked] https://www1.ietf.org/mailman/listinfo/mip6
 > >> 
 > 
 > 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 24 Apr 2006 20:33:37 +0200

Soliman, Hesham wrote:
> 
>>> => Of course. Both insecurities amount to a DoS attack, which 
>>> will not hijack any sessions, but will stop the MN from being 
>>> reachable.
>> 
>> Your affirmation is true _if_ the MN stores certs.  If it does, 
>> then the amount of preconfigured info is much larger than with 
>> DHAAD.
> 
> => I wasn't referring to the amount of information stored, I was 
> talking about the type of information.

So for you the type of preconfigured information is cert, then it's
better than if the type of information is SA key plus home prefix?

>> A simple method based on DHAAD would only store shared keys (not 
>> certs).
> 

Ok.

>> I guess the certs on the MN are no longer valid either -
> 
> => Why not? Certs are not tied to addresses unless you make them so, 
> but you shouldn't.

What are they tied to?  MAC address?  NAI? email address? FQDN?  Any of
these can change and so the cert on the MN can change.  No less than the
home prefix can change.

>> how do you update certs on the MN?
> 
> => You don't need to.

If one doesn't change it, and the cert is tied to the FQDN, and the 
respective company gets sold to some other company, and the domain name 
changes, then the mobile won't be able to authenticate to its HA unless 
one updates the cert on MN, no?

Alex