Subject: Re: [mobile-ip] Additional comments on draft-arkko-mipv6-bu-security-00.txt

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 06 Dec 2001 11:42:00 -0800

Hello Jari,

Jari Arkko wrote:

> Erik, thanks for your comments. I have some answers below:
> 
> > Section 6.4 talks about having a configuration knob to allow
> > unsecure BUs. I think this is a big mistake. Instead the WG should
> > develop some BU solution that can give some security comparable to
> > today's IPv4 security.
> 
> I agree! I have recently come to the conclusion myself that
> we should not allow unsecure RO at all, and as a minimum should
> require one of the weak auth protocols.

I was really surprised to read this.  Unsecure route optimization has
_never_ been allowable in the Mobile IP working group, neither for
IPv4 or for IPv6.  When has there been discussion otherwise?

Or am I misinterpreting something?

This was my biggest complaint against the original security requirements
draft.  There was so much analysis about what would go wrong with
unsecured Binding Updates, which were never allowable or specified in
any draft that I know of.  The real issues were thus obscured, and
the false impression was given that unsecured Binding Updates represented
a security vulnerability of Mobile IPv6.  The newer security requirements
draft is better in that it avoids making this misrepresentation.

Regards,
Charlie P.

---

From: "Jari Arkko" <[email-masked]>
Date: Thu, 6 Dec 2001 23:31:35 +0200

> IPv4 or for IPv6.  When has there been discussion otherwise?

There hasn't been - apparently I was the only one who was confused.
In any case, now we all agree that some security must be on all the
time.

Jari