Subject: Re: [seamoby] DMHA and IPsec

From: James Kempf <[email-masked]>
Date: Wed, 19 Sep 2001 08:46:16 -0700 (PDT)

Yoshi,

Good points.

Another problem w. IPSEC that occured to me was the "SA explosion"
problem. The Paging Agent would have to maintain an IPSEC SA with
all hosts that want to use it. This could pose a scalability problem
similar to the problem with CNs using IPSEC for binding updates
in MIPv6.

		jak

>Delivered-To: [email-masked]
>Date: Tue, 18 Sep 2001 20:15:18 -0400
>From: Yoshihiro Ohba <[email-masked]>
>To: [email-masked]
>Subject: [seamoby] DMHA and IPsec
>User-Agent: Wanderlust/2.7.3 (Too Funky) SEMI/1.14.3 (Ushinoya) FLIM/1.14.2 
(Yagi-Nishiguchi) APEL/10.3 MULE XEmacs/21.4 (patch 1) (Copyleft) 
(i386-debian-linux)
>X-Virus-Scanned: by AMaViS-perl11-milter (http://amavis.org/)
>
>
>Some of the DMHA proposals rely on IPsec for authenticating signaling
>messages, however, I think we should be careful about using IPsec in
>mobile environment (Mobile IPv6 is one example) and DMHA is not an
>exception.
>
>For example, I have the following cases in mind when using IPsec in
>DMHA.   
>
>When a host exits dormant mode, the typical rule is that the host
>sends a "deregistration" signaling message to the agent that has been
>registering the dormant host (and waits for an acknowledgment from the
>agent).  However, the subnet where a host enters dormant mode and the
>subnet where it exits dormant mode may be different, and if they are
>different, the host would end up with using a different source IP
>address for sending a deregistration message from that was used for
>sending a registration message.  If we rely on IPsec for
>authenticating these messages, the result is that a new (IPsec) SA
>would need to be established in order to just perform deregisration
>(because source IP address is used for identifying an IPsec SA), which
>would increase signaling delay and impact on battery consumption of
>wireless hosts.  The same thing would apply when a dormant host sends
>an agent a message which is used for updating the current paging area.
>
>This is one of the reasons for LH-DMHA to use a higher layer
>authentication mechanism instead of IPsec.
>
>Yoshihiro Ohba
>
>
>

---

From: Marco Liebsch <[email-masked]>
Date: Wed, 19 Sep 2001 18:12:38 +0200

James,

isn't this the case for transport layer security as well? For TLS I see the
problem you addressed only shifted to higher layers.

Marco

---

From: Behcet Sarikaya <[email-masked]>
Date: Wed, 19 Sep 2001 11:38:30 -0400

All,
  A problem we  faced is this:
How can we talk about moving in the paging areas and at the same time not
supporting a mobility protocol (as stated in the requirements doc). If it is a
fixed node like an Internet Appliance which is moved to another place, isn't it
best to reconfigure it?
  The requirements document at one point talks about Target Agent on page 7.
What is target agent?

James Kempf wrote:

>  This could pose a scalability problem

Kind regards,

--
Behcet

---

From: Pars MUTAF <[email-masked]>
Date: Fri, 21 Sep 2001 01:40:59 +0200

Hello;

Just checking if I missed something:

The SAs that are mentioned in this discussion are:

    1. Between DMHs and paging agents? Or,
    2. Between CNs and and paging agents?

I think the second one is impossible. Because,
the CNs cannot be forced to establish SAs with
unknown third parties such as paging agents (this
would violate IPsec).

Another conclusion is that IPsec does not help defend
against DoS attacks that exploit IP paging.

What do you think? I'd like to know it if this is a premature
conclusion. Can someone imagine an IPsec based defense
against DoS attacks?

I think per-host filtering rules can be a solution. But
filtering is a very difficult topic.

Regards,
pars