Subject: Re: [Fwd: Re: [mobile-ip] Piggybacking - DT recommendation]

From: Francis Dupont <[email-masked]>
Date: Sun, 03 Mar 2002 17:13:28 +0100

> The problem is, I don't know what you mean by "the policy".
     > We are dealing with authentication of IP-level data as
     > received by a correspondent node.  Thus, "the policy"
     > would be geared towards verification of data from a
     > single IP address (e.g., xxxx:...:xxxx/128) (a home
     > address).  We are NOT dealing with NAI, and we are
     > NOT dealing with prefixes of length less than 128.
   
   => My points are: 
   
   - what is the identity used to establish an SA?

=> HoA address (no need for something else between a MN and a CN).

   - Just because you have an SA with
   that identity does that mean that they can
   modify your routing table (that's effectively
   what a BU does). 
   
=> yes, if you are authorized to do that you are authorized to do that,
where is the problem?

   The ownership of a HoA does NOT give you the right

=> we don't speak about ownership, but about strong authentication
and authorization.

   to forward traffic to any address (CoA) on
   the Internet.

=> this is what is authorized, and you need the strong authentication
in order to really verify the BU is from the node using the HoA.
Is your concern the MN may reroute the traffic to itself to
a fake CoA? (note this traffic will contain your HoA in a RH type 2)

   Being a certain identity in a certificate
   ..etc does not necessarily authorise you
   to divert traffic from an address (HoA), 
   unless the HoA is included in your identity
   somehow.

=> we agree

   And you still need to prove that 
   you own a CoA of course. 
   
=> no, you don't need.

   Authenticating someone doesn't necessarily 
   give them authorisation to do whatever they 
   want.

=> we lost one year with the authentication is not authorization thread,
please, not again.

   For the BU, the proof of ownership 
   for the HoA and Coa is needed. 
   
=> I disagree. Strong authentication of the HoA and authorization to
perform BUs are enough too.
   
   => What's AAA doing here? My response
   was on manually configured SAs!
   
=> nobody uses configured SAs, please put real tools (IKE for instance)
in the context.
   
Regards

[email-masked]