Subject: RE: [mobile-ip] Security on Local "Home Agent" Functionality?

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Sat, 16 Mar 2002 00:14:42 +0100

=> Well, if it's to the link local address
then we would have a problem. It needs 
to be an address with larger scope I think.

  > 
  > then we could remove the problem of how to secure
  > off-link router<->host and be left only with
  > the problem of how to secure host<->local link router.
  > This is a generic IPv6 ND problem, as we have
  > been discussing in the IPNG list, and so a solution
  > for ND would work for FMIPv6 also. 

=> There is an additional complication for FMIPv6. 
The DT recommended that RR is needed for the 
CoA as well. So this would make life extremely
complicated for FMIPv6 to be able to forward
before you move. 

I think we need to spend more time on it.

Just like
  > MIPv6 uses standard ND signaling for CoA
  > aquistion, instead of special signaling as in MIPv4.

=> ND does not have a concept of a HoA. The problem
with MIPv6 is that you need to verify 2 addresses. 
The problem with forwarding before moving is 
that you're essentially asking for a bombing attack
for a short period of time :) (until you verify
your CoA). 

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Fri, 15 Mar 2002 15:57:38 -0800

Let's talk about it off line next week. Maybe CT will help, though I've
heard some arguments against using CT for IPsec context. I'm hoping we
can have some of these issues worked out by Yokohama.

            jak

----- Original Message -----
From: "Hesham Soliman (ERA)" <[email-masked]>
To: <[email-masked]>; "Erik Nordmark"
<[email-masked]>
Sent: Friday, March 15, 2002 3:14 PM
Subject: RE: [mobile-ip] Security on Local "Home Agent" Functionality?