Subject: Re: [mobile-ip] comments on draft-mkhalil-mobileip-ipv6-sap-00.tx t

From: "Phil Neumiller" <[email-masked]>
Date: Mon, 2 Apr 2001 11:33:00 -0500

RE: [mobile-ip] comments on draft-mkhalil-mobileip-ipv6-sap-00.txtHello Haseeb, 

Some comments below.

----- Original Message ----- 
From: Haseeb Akhtar 
To: [email-masked]' 
Cc: 'Phil Neumiller' 
Subject: RE: [mobile-ip] comments on draft-mkhalil-mobileip-ipv6-sap-00.tx t

Comments below. 

-----Original Message----- 
From: Phil Neumiller [mailto:[email-masked]] 
To: mobile-ip 
1).  This draft belongs in the security working area of the IETF. 

2).  The MIP group is not qualified to make a security assesment of this draft. 

=> I will let the co-chairs/AD decide that. As far as we know, the WG is looking 

In the IETF, the chairs are to guage the WG consensus on issues not make

decisions like this.

=> for a security solution for IPv6. The IESG also has specifically requested 
=> for such in the mailing list. A lot of discussions for last few days, 
=> too, has been around this very topic. 

This is good.  Which list are your referring to BTW?

3).  Why should the security association between an MN and a CN be all 
       that much different from other types of clients and servers and peers 
       that run on the Internet?  Why enmesh the security terminology with 
       MIP terminology?  (cohesion is still a bad design choice after all these 
        years).  Build a generalized solution for the Internet that MIP can use. 

=> Since this is MIP WG and we are particularly concerned about a problem 
=> that involves CN and MN and this interface happens to use Binding Update / 
=> Binding Request etc. 

That is fine.  What I suggest is that use your draft as a requirements document

and feed it to the security working group and let them work on solutions.  The

MIP WG is not qualified to perform crypt-analysis and build crypto-graphically

strong systems nor is it chartred to do so.  This is a waist of everybodies time

on this list.

4).  In the Abstract,  How fast is "fast"?  What is the baseline? 

=> Phil, if you feel comfortable, we can take out the reference to "fast" from 
=> the draft in the next revision. Our objective was to propose a baseline solution 
=> to the security problems of IPv6. 

On less you have some kind of baseline its a marketing term.

5).  Can't a security association be used for all sorts of other good stuff besides 
       MIP binding updates (related to 2 above). 

=> Of course, it can. The main question, however, does the proposed scheme satisfy 
=> dissatisfy the requirements of this WG. 

What are the requirements of this WG?  Where are those documented?

6).  As for the rest of the draft, I saw no references to the specific Diffie Hellman 
       work you were applying, no references to patents you were using (expired 
       or not), I saw one vague reference to some of Charlie's work, I am 
       supposed to believe that this work will lead to something cryptographically 
       secure? 

=> That is an oversight. We will include all the references in the next version. 
=> I'm not aware of any patent that needed to be used. Any help in this regard 
=> will be appreciated. 

Diffie Hellman public key exchange was patented and the rites were

owned by RSA part of pkix and some of these patents expired a few years back.

I am very surprised by your question and again, I believe this work belongs in

a security WG.

       I believe this type of work needs to be reviewed in the MIP WG after it 
       goes through some severe scrutiny in the security area where there 
       are domain experts in security.  

=> Agreed. 

Good then, could the name of the draft be changed to "req" for requirements.

This is the way the AAA work in the MIP WG is proceeding.

       Most people in the MIP WG want 
       mobile security in the worse way, but are not security domain experts. 

Best Regards, 

Phil

---

From: "Haseeb Akhtar" <[email-masked]>
Date: Mon, 2 Apr 2001 10:21:47 -0500

Comments below.

-----Original Message-----
From: Phil Neumiller [mailto:[email-masked]]
Sent: Monday, April 02, 2001 7:17 AM
To: mobile-ip
Subject: [mobile-ip] comments on draft-mkhalil-mobileip-ipv6-sap-00.txt

Hello, 

2).  The MIP group is not qualified to make a security assesment of this
draft.

=> I will let the co-chairs/AD decide that. As far as we know, the WG is
looking
=> for a security solution for IPv6. The IESG also has specifically
requested
=> for such in the mailing list. A lot of discussions for last few days, 
=> too, has been around this very topic.

3).  Why should the security association between an MN and a CN be all
       that much different from other types of clients and servers and peers
       that run on the Internet?  Why enmesh the security terminology with
       MIP terminology?  (cohesion is still a bad design choice after all
these
        years).  Build a generalized solution for the Internet that MIP can
use.

=> Since this is MIP WG and we are particularly concerned about a problem
=> that involves CN and MN and this interface happens to use Binding Update
/
=> Binding Request etc.

=> Phil, if you feel comfortable, we can take out the reference to "fast"
from
=> the draft in the next revision. Our objective was to propose a baseline
solution
=> to the security problems of IPv6.

5).  Can't a security association be used for all sorts of other good stuff
besides
       MIP binding updates (related to 2 above).

=> Of course, it can. The main question, however, does the proposed scheme
satisfy
=> dissatisfy the requirements of this WG.

6).  As for the rest of the draft, I saw no references to the specific
Diffie Hellman
       work you were applying, no references to patents you were using
(expired
       or not), I saw one vague reference to some of Charlie's work, I am
       supposed to believe that this work will lead to something
cryptographically
       secure? 

=> That is an oversight. We will include all the references in the next
version.
=> I'm not aware of any patent that needed to be used. Any help in this
regard
=> will be appreciated.

       I believe this type of work needs to be reviewed in the MIP WG after
it
       goes through some severe scrutiny in the security area where there
       are domain experts in security.  

=> Agreed.

       Most people in the MIP WG want 
       mobile security in the worse way, but are not security domain
experts.

=> We try to address the problems that are part of this WG.

Best Regards,

Phil

=> Regards,

=> Haseeb