Subject: [seamoby] DMHA and IPsec

From: Yoshihiro Ohba <[email-masked]>
Date: Tue, 18 Sep 2001 20:15:18 -0400

Some of the DMHA proposals rely on IPsec for authenticating signaling
messages, however, I think we should be careful about using IPsec in
mobile environment (Mobile IPv6 is one example) and DMHA is not an
exception.

For example, I have the following cases in mind when using IPsec in
DMHA.   

When a host exits dormant mode, the typical rule is that the host
sends a "deregistration" signaling message to the agent that has been
registering the dormant host (and waits for an acknowledgment from the
agent).  However, the subnet where a host enters dormant mode and the
subnet where it exits dormant mode may be different, and if they are
different, the host would end up with using a different source IP
address for sending a deregistration message from that was used for
sending a registration message.  If we rely on IPsec for
authenticating these messages, the result is that a new (IPsec) SA
would need to be established in order to just perform deregisration
(because source IP address is used for identifying an IPsec SA), which
would increase signaling delay and impact on battery consumption of
wireless hosts.  The same thing would apply when a dormant host sends
an agent a message which is used for updating the current paging area.

This is one of the reasons for LH-DMHA to use a higher layer
authentication mechanism instead of IPsec.

Yoshihiro Ohba

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 19 Sep 2001 10:27:47 +0200

Hello Yoshihiro,

I agree with your analysis but not quite with your conclusion....

One solution might be to extend IPSec to solve this problem by using the
MN's home address
instead of the CoA  for example (then the SA does not need to be
modified)...

Higher level authentication will make the DMHA protocol even more
complex....

Claude.

--

----------------------------------------
Claude CASTELLUCCIA, INRIA Rhone-Alpes
ph:  +33 4.76.61.52.15 (fax: 52.52)
http://www.inrialpes.fr/planete/

---

From: Marco Liebsch <[email-masked]>
Date: Wed, 19 Sep 2001 15:27:51 +0200

Hello,
taking the home address would be one possibility, taking another more
static identifier like the IMSI, is an alternative. This would make it
independent of Mobile IP. The end-to-end security between the mobile
node and its respective Paging Agent is ensured, since re-calulation of
the authentication value proofs this on the receiver side. The
respective acquired CoA could be used for calculating the authentication
value. What is to be ensured is that the Paging Agent has an appropriate
binding of a more static identifier and the respecive key in its table.
The basic idea in using IPSec is to make use of an architecture which is
already being specified rather than introducing a further one. If it
will be discovered that IPSec is not sufficient for respective security
considerations, transport layer security might be an option.

Marco

Claude Castelluccia wrote:

> One solution might be to extend IPSec to solve this problem by using
> the MN's home address

---

From: Yoshihiro Ohba <[email-masked]>
Date: Wed, 19 Sep 2001 10:01:19 -0400

Hi Claude,

At Wed, 19 Sep 2001 10:27:47 +0200,
Claude Castelluccia wrote:
> 
> [1  <text/plain; us-ascii (7bit)>]
> 
> [2  <text/html; us-ascii (7bit)>]
> 
> 
>  
> Hello Yoshihiro,
> 
> One solution might be to extend IPSec to solve this problem by using the MN's
> home address
modified)...

If home address is used, the MN with a new CoA cannot receive an
acknowledgement from a DMHA agent (a DMA or a TA) without performing
mobility binding update.  This could be solved by performing
deregistration from a DMHA agent and binding update at the same time
in a single message exchange (let's call it "combined signaling"), but
(i) it would not make sence for an MN to perform paging area update
and mobility binding update at the same time, and (ii) the combind
signaling with IPsec authentication cannot be appled to Mobile IPv4
since MIPv4 registration is performed at higher layer.

complex....

I think more detailed analysis would be needed to say so.

Yoshihiro Ohba

---

From: Claude Castelluccia <[email-masked]>
Date: Thu, 20 Sep 2001 09:22:27 +0200

Hello,

> and mobility binding update at the same time, and (ii) the combind

why not? I actually think it makes a lot of sense....

> since MIPv4 registration is performed at higher layer.

who cares about IPv4 ;-) (just kidding!).

--

---

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 20 Sep 2001 13:37:01 -0400

Claude,

At Thu, 20 Sep 2001 09:22:27 +0200,
> why not? I actually think it makes a lot of sense....

It does not make sence because it is equivalent to updating
routability and locatablity at the same time, which would require more
signaling traffic than just updating locatability.  Actually, the
combined signaling needs the signaling messages to go all the way back
to the home agent, which would not be desired because reduced
signaling is one of the purposes of IP paging.

Even more, the combined signaling also depends on the use of a
mobility management protocol (specifically Mobile IPv6), which would
not satisfy RFC3154 in that it cannot be applied to hosts that do not
have mobility management protocol at all.

Based on the series of discussion on this thread, I would like to
conclude that IPsec is inappropriate method for authenticating DMHA
messages originated from or destined for hosts.

Yoshihiro Ohba