Subject: RE: [mobile-ip] Piggybacking - DT recommendation

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 4 Mar 2002 05:10:36 +0100

Francis,

OK, so I'm not the only one who goes on holidays and
tries to catch up with old email :)

  >    Just because you have an IPsec SA, doesn't mean you
  >    are authorised to send the BU. It's an address
  >    ownership problem and that's why we need RR. 
  >    
  > => I would not like to go backward in the Mobile IPv6 
  > security issue,
  > so do you accept an IPsec SA with the proper authorization is
  > enough to protect the BU, yes or no? (i.e. do you agree with
  > I-D 00-15 or not about the security constraints?)

=> I think it's enough to authorise the use 
of the HoAö if included inside the Certs. However,
the issue was brought up by the DT and several
drafts to highlight that there is a need
to prove ownership of the CoA to avoid 
bombing attacks. You clearly disagree with
that. It took me some time to understand
whether there is a significant difference 
between bombing someone directly or via a CN. 
I must admit I'm still not 100% convinced
that there is a significant difference. But 
I'm not as sure as you are that it is irrelevant. 

Hesham

---

From: Francis Dupont <[email-masked]>
Date: Mon, 04 Mar 2002 10:03:18 +0100

OK, so I'm not the only one who goes on holidays

=> holidays? What is this thing... (:-).

   and tries to catch up with old email :)

=> they are not so old because the IPsec issue is not solved.

   bombing attacks.

=> bombing attacks when all packets include the HoA in a RH type 2.
I don't believe this is a serious threat!

   You clearly disagree with that.

=> YES!

   It took me some time to understand
   whether there is a significant difference 
   between bombing someone directly or via a CN. 

=> there is a clear difference: directly you should use forged source
addresses and go through ingress filtering, via a CN *with RO* you
only expect the target doesn't notice the RH in each packet (:-).

=> do you agree with my argument?

Regards

[email-masked]