Subject: [seamoby] Paging ID submission

From: Rajeev Koodli <[email-masked]>
Date: Tue, 18 Sep 2001 14:03:55 -0700

Hello folks,

we submitted the following draft to I-D registrar yesterday. We would
like it to be considered for IP Paging effort in the working group.

Regards,

-Rajeev

http://people.nokia.net/~rajeev/draft-koodli-seamoby-paging-00.txt

---

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 18 Sep 2001 17:22:30 -0500

Folks,
  As promised we submitted an I-D on
Layer-2 aided mobility independent dormant host alerting
                             protocol
it can be accessed for now from:
http://www.geocities.com/bsarikaya/draft-guri-seamoby-lahap-00.txt

We also submitted an accompanying I-D:
Conformity Statement of Layer-2 aided mobility independent dormant host
                      alerting protocol to RFC 3154
it also can be accessed from:
http://www.geocities.com/bsarikaya/draft-guri-seamoby-conflahap-00.txt
  These drafts should be available from IETF drafts directory shortly.

  Many thanks to Pat Calhoun for being flexible and to Jim Kempf for his
diligence on the rules set forward at London, UK.

Regards,

--
Behcet

---

From: Pars MUTAF <[email-masked]>
Date: Wed, 19 Sep 2001 18:25:29 +0200

Hello the authors of:

draft-guri-seamoby-lahap-00.txt
draft-sarikaya-seamoby-mipv6hp-00.txt

I was a little bit confused when I saw the following
statement in your drafts:

 ``One category of attacks is DoS Amplification attack of section 3.1 in
   [3], in which bogus paging requests are wide casted across the
   network. This attack is prevented by taking advantage of the source
   authentication which IPsec provides. With IPsec, only authorized and
   authenticated nodes can initiate paging. If an authenticated node
   misbehaves then it can be removed from the list of authorized users.
   IPsec source authentication also solves the Queue Overflow attack of
   section 3.2 in [3].''

Could you please explain how your paging agents check the authenticity of
the packets without having the keys? I would be happy to see the comments
of IPsec experts that I see in the authors list.

Thank you.

Regards,
pars

---

From: Behcet Sarikaya <[email-masked]>
Date: Thu, 20 Sep 2001 11:31:53 -0400

Hi Pars,
  I am not a security expert. The security section in our drafts has been
contributed by Andrew and he does not read emails in this distribution list
regularly. I'll try to get him answer you asap (if not done already).
  Sorry for the late reply.
  However I believe that the WG should now concentrate on the next steps: we
have 5 drafts submitted.
What is the next step?

Regards,

--
Behcet

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 20 Sep 2001 21:24:26 -0700

> What is the next step?

protocol evaluation. I need to work out the details and get back to folks on
the list. Expect an e-mail sometime tomorrow.

Thanks,

PatC

---

From: "Andrew Krywaniuk" <[email-masked]>
Date: Tue, 25 Sep 2001 14:25:38 -0400

Hi Pars,

It is possible to use IPsec in a nested tunnels configuration. Envision the
following connection profile:

A ----{Internet}------ gateway ------ B

In scenarios where one wishes to provide authenticated ingress filtering to
a LAN, the recommended solution is to set up two tunnels. The outer tunnel,
from A to the gateway, is authentication only; it provides source
authentication and DoS filtering. The inner tunnel, from A to B, provides
end-to-end security. This scenario has not been widely deployed yet, but the
IPsec and IPSP WGs have been careful to ensure that it will work. The route
through the gateway can be preconfigured on each authorized host, or it can
be discovered through DNS or via a gateway discovery protocol (to be
developed by IPSP).

Someone else asked about what happens if you want to support arbitrary (i.e.
not specifically authorized) hosts. That is a very difficult question
indeed. The first thing to realize is that you cannot prevent a DoS attack
in this case; you can only detect it, determine its source, and blacklist
that IP. This may work or it may be hopeless, depending on whether the
attacker has an army of DDoS zombies at his disposal. The basic idea is the
same as above: Set up an SA from A to the gateway and authenticate A's
address using a credential which is bound to a specific IP (or any other
limited-issue commodity). If the sender turns out to be a DoS attacker then
drop the SA and blacklist that IP. Other partial-solutions to this problem
are possible, but for the sake of brevity I won't get into them here.

I will add some clarification of these points in a future version of the
draft.

Andrew
-------------------------------------------
Upon closer inspection, I saw that the line
dividing black from white was in fact a shade
of grey. As I drew nearer still, the grey area
grew larger. And then I was enlightened.

> -----Original Message-----
> From: Behcet Sarikaya [mailto:[email-masked]]
> Sent: Thursday, September 20, 2001 11:32 AM
> To: Pars MUTAF
> Cc: [email-masked]; [email-masked]
> Subject: Re: [seamoby] Paging ID submission
>
>
> Hi Pars,

---

From: Pars MUTAF <[email-masked]>
Date: Thu, 27 Sep 2001 03:32:11 +0200

Hello and thank you for the reply.

> be discovered through DNS or via a gateway discovery protocol (to be

Do you think that the IPSP protocol is being designed for a cellular public
network with millions of ``highly mobile'' hosts and millions of cells?
Secondly,
one important motivation of paging is to minimize the signaling costs due to
location management in cellular networks. IPsec and IPSP based solutions would
require many message exchanges upon each dormant mode registration of
each host. This may reduce the motivations of paging.

Another question that comes to mind: is IPSP possible in a public
environment. What do you think?

Finally, the IPSP language is complicated for a wireless environment.
We should not forget that paging is used for saving scarce resources
e.g. bandwidth and battery.

More comments? Thanks.

Regards,
pars