Subject: RE: [NSIS] Session in NSIS

From: Tschofenig Hannes <[email-masked]>
Date: Thu, 19 Feb 2004 17:10:31 +0100

hi Nary Tra, 

~ snip~

> hannes, the session-id can be randomly created, however, do 
> you think which
> signaling entity should do it (NI, NR or other entities).  i  
> read your sid
> draft, but it did not answer completely me.
i personally think that it should be done by the ni. if we create the
session id with cryptographic properties (such as a hash of a public key)
then the answer depends a bit on the outcome of the mobility discussion. i
have described the problems at some level of detail in the
manyfolks-mobility draft. unfortunately, i haven't seen many comments yet.
(actually, i haven't seen many comments on the sid draft as well.)

ciao
hannes

> 
> Nary Tra
> ENST, Paris.
> 
> 
> 
> _______________________________________________
> nsis mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/nsis
> 

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Xiaoming Fu" <[email-masked]>
Date: Thu, 19 Feb 2004 17:41:43 +0100

> session id with cryptographic properties (such as a hash of a public key)

I agree NI could be the place. Nevertheless, it might be a concern if we 
create reasonable amount of sessions in a single NI - profiling of the our 
implementation showed the crypto-sid generation costs 58% of the overall 
processing in NI in repeated experiments. Thus, it should be taken into 
consideration in mobilility considerations, given the limited computing 
power in mobiles... however if we put NR into the place of sid generator, 
some servers can suffer certain dos attacks (if i'm right).
Xiaoming

---

From: "Cheng Hong" <[email-masked]>
Date: Fri, 20 Feb 2004 09:37:55 +0800

Hi Xiaming,

> some servers can suffer certain dos attacks (if i'm right). Xiaoming 

It is not necessary that the NI always be the mobile. Also, wouldn't the
computation cost just an implementation issue? If it is that computational
intensive, could it be placed into certain hardware, e.g. some smart card?

Another issue for NR generating the id would mean that the first message
sent from NI would not carry the SID information. Does this have any impact
on the design of the protocls?

Cheers

Cheng Hong

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Xiaoming Fu
> Sent: Friday, February 20, 2004 12:42 AM
> To: Tschofenig Hannes
> Cc: 'Thanh Tra LUU'; nsis
> Subject: [NSIS] Re: Session in NSIS
> 
> 
> > session id with cryptographic properties (such as a hash of 
> a public 
> > key)
> 
> some servers can suffer certain dos attacks (if i'm right). Xiaoming 
> 
> > then the answer depends a bit on the outcome of the mobility 
> > discussion. i have described the problems at some level of 
> detail in 
> > the manyfolks-mobility draft. unfortunately, i haven't seen many 
> > comments yet. (actually, i haven't seen many comments on 
> the sid draft 
> > as well.)
> > 
> > ciao
> > hannes
> > 
> >> 
> >> Nary Tra
> >> ENST, Paris.
> >> 
> >>  
> >>

---

From: "Thanh Tra LUU" <[email-masked]>
Date: Fri, 20 Feb 2004 11:38:51 +0100

hi Cheng Hong,

> on the design of the protocls?

i think it maybe a problem. Seeing NAT/FW, NI and NR can initiate its own
session

 NI ---> NAT/FW_I ----> Internet---->NAT/FW_R---->NR.

NR can initiate the signaling session and some states are established on
NAT/FW_R to permit NI can send signaling message to it. This session-id is
sent by SIP or other means.

Nary Tra,
ENST, Paris.

---

From: "Cheng Hong" <[email-masked]>
Date: Fri, 20 Feb 2004 19:03:26 +0800

Hi Nary,

Does this mean that the SIP or other types of signaling has be used in
conjunction of the NSIS signaling to achieve the NR SID generation? Wouldn't
it be a bigger issue?

Cheers

Cheng Hong

> From: Thanh Tra LUU [mailto:[email-masked]] 
> Sent: Friday, February 20, 2004 6:39 PM
> To: Cheng Hong
> Cc: 'nsis'
> Subject: Re: [NSIS] Re: Session in NSIS
> 
> 
> hi Cheng Hong,
> 
> > It is not necessary that the NI always be the mobile. Also, 
> wouldn't 
> > the computation cost just an implementation issue? If it is that 
> > computational intensive, could it be placed into certain hardware, 
> > e.g. some smart card?
> >
> > Another issue for NR generating the id would mean that the first 
> > message sent from NI would not carry the SID information. Does this 
> > have any
> impact
> i think it maybe a problem. Seeing NAT/FW, NI and NR can 
> initiate its own session
> 
> NR can initiate the signaling session and some states are 
> established on NAT/FW_R to permit NI can send signaling 
> message to it. This session-id is sent by SIP or other means.
> 
> Nary Tra,
> ENST, Paris.
> 
> 
> 
>

---

From: "Thanh Tra LUU" <[email-masked]>
Date: Fri, 20 Feb 2004 12:51:03 +0100

hi Cheng,

>conjunction of the NSIS signaling to achieve the NR SID generation?
Wouldn't

i think it's an open issue now. however, imho, it is possible to let other
entities (NR, third party...) create session-id. for example, in the case
bidirectional, NR and NI can create the session-id.

Nary Tra,
ENST, Paris.