Subject: Re: [mobile-ip] Piggybacking - DT recommendation

From: Francis Dupont <[email-masked]>
Date: Sun, 03 Mar 2002 17:42:41 +0100

The above assumes that there are CAs for PKIs that will
   actually put IP addresses as subject(Alt)name,

=> CAs may do that (and OpenBSD certpatch can help to add that :-).

   and that folks will
   actually trust those CAs to have correct IP addresses in the certs.
   
=> basically folks trust CAs (:-)!

   It also assumes that the IETF community thinks it is a bad idea
   to keep IP addresses in certificates. RFC 2956, which is a report from
   an IAB workshop, in section 3.4 seems to indicate that this might
   not be considered a good idea but instead something that should be
   avoided.
   
=> I agree but the end of section 3.4 stands:

   Ubiquitous deployment of the Secure DNS Extensions ([8]) should be
   strongly encouraged to facilitate widespread deployment of IPsec
   (including IKE) without address-based Identity types.

So until we have a secured way to verify name-address mapping
(DNSSEC is the obvious candidate) I am reluctant to encourage
IKE phase one where the addresses can not be verified (this
should be allowed but with restriction, look at my I-D about
IPsec and Mobile IPv6 for the beginning of a discussion.
BTW this is an 100% IPsec topic).

   Given your text above I think you omitted a few conditionals here like
   - the subject(atl)name in the certificate used to create the IPsec SA
     is the HoA, and
   - the IKE implementation verified that this IP address was used during
     the key exchange

=> Mike's message seemed to assume manual keying...
BTW I agree with your conditionals (and added some others in my I-D).

Thanks

[email-masked]

PS: do you know why RFC 2956 section 3.4 is explicitely about IPv4
addresses (32-bit IP addresses)? Is there something I've missed?

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 4 Mar 2002 14:41:40 +0100 (CET)

Francis wrote:
> I Wrote:

BTW: This is habout ow to *use* IPsec for MIPv6. When discussing how to use 
tools like hammers to build things like buildings it probably isn't useful
to defer that to the "hammer" working group.

I'm trying to work out an example of where an MN tries to use IKE to do a BU
with a CN.
It goes something like this:
 - MN kicks IKE to set up a SA to use for the BU
	Must the MN verify that it has a certificate with its HoA as
	subject(alt)name to do this?
	No, because then it would not be able to take advantage of the DNSSEC
	reference above. Thus an IPsec SA is always attempted.
 - MN/CN finishes with SA establishment
	If the subject(alt)name was the home address then the CN can conclude
	that BUs protected by the SA are authorized for that Home Address.
	If not the CN does a DNS lookup of the hostname in the certificate
	subject(alt)name. It must use DNSsec for this i.e. all signature
	chains must be verified (the way DNSsec normally does it).
	If (one of) the IP addresses returned from the DNS is the HoA
	then BUs protected by the SA are authorized for that HoA.
	If the subject(alt)names are only mbox names (such as
	[email-masked]) then this will fail and the SA is
	not useful for authorizing BUs.

Does the above make sense?

The looup of a hostname (FQDN) with DNSsec validation is presumably more
expensive than the extra roundtrip caused by using RR together with IPsec.
And if RR is used together with IPsec you can also handle things
for mbox certificates.

> addresses (32-bit IP addresses)? Is there something I've missed?

I don't recall the exact discussion but I think this is written the
way it is because the workshop was looking at how to handle the IP layer issues
and IPv6 wasn't taken as granted as the solution at that point in time. Thus
folks were looking for places where identifying nodes using IPv4 address would
cause problems.

  Erik

---

From: Francis Dupont <[email-masked]>
Date: Sun, 17 Mar 2002 17:24:18 +0100

=> catching an old mail...

   
=> yes, DNSsec moves the "should use IP addresses" to "should use FQDNs".

   The lookup of a hostname (FQDN) with DNSsec validation is presumably more
   expensive than the extra roundtrip caused by using RR together with IPsec.

=> this argument is valid if IPsec is used *only* for BU protection.
My concern is when IPsec is used for another reason, it should be allowed
to protect BUs too without extra-overhead (no RR for instance).

=> I strongly disagree: we should not mixed RR which has easy MITM
problems with strong authentication is the final goal is or
can be strong authentication.

Thanks

PS: this is more IPsec discussion than mobile IP.