Subject: [MEXT] Review of I-D draft-korhonen-mext-mip6-altsec-06

From: "Jan Zorz @ go6.si" <[email-masked]>
Date: Thu, 20 Jan 2011 09:34:18 +0100

Hi,

It took me quite long to write this review, but finally, here it is :)

Review comments:

In general the proposal of using an alternative to IPsec and IKEv2
seems quite okay. The main purpose of Mobile IPv6 is to enable
mobility at the IP layer and hence using TLS which is much more widely
implemented and deployed for use to secure the signaling is good.

More specific comments:

- The proposal introduces a new element called HAC. In terms of
   deployments such a network element may become central for
   bootstrapping Mobile IPv6. The I-D states that the HAC could be
   co-located with the HA. In reality, the HAC should be a standalone
   entity which interacts with AAA and policy engines in a network.

- TLS is widely used for security in the Internet today. Hence the use
   of TLS does not weaken mobile IPv6 security. TLS is also used only
   for bootstrapping and not for securing the signaling or traffic.

- Describe the steps in figure 1.

- The security association scope says that it describes whether the SA
   is only for signaling or for data as well. Would be useful to make
   it more explicit.

- Route optimization is an important feature of Mobile IPv6. Hence
   this alternate security solution should explain how the route
   optimization signaling messages are secured.

- Unclear why HTTP headers (Sec 8.2) are being reserved. Could not
   really understand the purpose.

- Message details are fairly complete and hence should be
   implementable.

In summary, the draft is well written and complete and should be
considered for standardization.

I'm using DSMIP6-TLS implementations on N900 phone and Ubuntu Linux 
laptop in everyday life and it seems to work quite well. There are still 
some implementation issues that needs to be fixed, but overall feeling 
is very satisfactory.

Regards, Jan Zorz
go6.si

---

From: jouni korhonen <[email-masked]>
Date: Thu, 20 Jan 2011 11:31:08 +0200

Hi Jan,

Thanks for the review! We will reflect these along those comments received from Ryuji and Domagoj. Some more detailed comments inline.

>  entity which interacts with AAA and policy engines in a network.

That is purely an implementation issue. We will add some more text around this topic.

>  for bootstrapping and not for securing the signaling or traffic.

Right. However, bootstrapping agrees on ciphers that are available for TLS and at the implementation level we then use those ciphers available in TLS library. So in a way we still utilize TLS code base for signaling & traffic ciphering.

> - Describe the steps in figure 1.

ok.

>  is only for signaling or for data as well. Would be useful to make

Ok.

>  optimization signaling messages are secured.

Currently the I-D scopes route optimization out. That is stated at the very end of the document though. We have been thinking to add route optimization support though.

>  really understand the purpose.

Just a left over from earlier revisions.

> I'm using DSMIP6-TLS implementations on N900 phone and Ubuntu Linux laptop in everyday life and it seems to work quite well. There are still some implementation issues that needs to be fixed, but overall feeling is very satisfactory.
> 

Thanks.

- Jouni

> Regards, Jan Zorz
> go6.si
> _______________________________________________
> MEXT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mext

---

From: "Jan Zorz @ go6.si" <[email-masked]>
Date: Thu, 20 Jan 2011 10:36:38 +0100

On 1/20/11 10:31 AM, jouni korhonen wrote:
> Currently the I-D scopes route optimization out. That is stated at
> the very end of the document though. We have been thinking to add
> route optimization support though.

Jouni, hi.

I think this is essential and *must* be in there. Of what use is all 
mobility stuff if there is no route optimization?

I understand that mobile operators are a bit nervous about that, but 
this shouldn't be a reason not describing/defining route optimization in 
I-D and do it in implementation.

Regards, Jan

---

From: [email-masked] (Arnaud Ebalard)
Date: Thu, 20 Jan 2011 10:35:08 +0100

"Jan Zorz @ go6.si" <[email-masked]> writes:

> this shouldn't be a reason not describing/defining route optimization
> in I-D and do it in implementation.

+1

---

From: <[email-masked]>
Date: Thu, 20 Jan 2011 21:55:56 +0000

Thanks for the review.

Support for route-optimization with the proposed security solution in this
I-D is possible.
We will describe this in more details in the next rev while also
addressing some of your other comments..

-Raj