Subject: RE: [Mip6] I-D ACTION:draft-mkhalil-mipv6-nai-00.txt

From: "Barany, Pete" <[email-masked]>
Date: Sat, 18 Oct 2003 10:09:24 -0700

I too have questions about this (or perhaps I misunderstand). The I-D
mentions the use of IKE/IPsec (where IKE is a "MAY" in Mobile IPv6) ...
but the whole point of using IKE ISAKMP SA and the IKE IPsec SA in the
first place is to start by authenticating the BU. In IKE Phase 1, if you
cannot use the IP_V6_ADDR Identification Type in the ISAKMP
Identification payload, then you can simply use ID_USER_FQDN
Identification Type (i.e., [email-masked] ... which is an NAI).

Also, how is the HA supposed to assign an IPv6 address to the MN if the
requested IPv6 address is set to zero? IPv6 (nor MIPv6) do not work that
way.

Pete

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of T.J.
Kniveton
Sent: Friday, October 17, 2003 3:09 PM
To: [email-masked]
Subject: Re: [Mip6] I-D ACTION:draft-mkhalil-mipv6-nai-00.txt

[email-masked] wrote:
> 
> A New Internet-Draft is available from the on-line Internet-Drafts
directories.
> 
>         Title           : Mobile IP Network Access Identifier
Extension for IPv6
>         Author(s)       : M. Khalil, et. al.
>         Filename        : draft-mkhalil-mipv6-nai-00.txt
>         Pages           : 0
>         Date            : 2003-10-17
> 
> This document defines a way for the mobile node to identify itself,
> by including the NAI with the MIPv6 Binding Update messages.

I have some comments and questions on the draft, if you're ready for
them.

Is there supposed to be any way to authenticate a user as owning a
particular
NAI? Are you planning on integrating the use of AAAv6, PANA, or some
other
method?

   Upon receiving the Binding Update, the HA will first verify 
   the authenticity of the Binding Update. It will then attempt
   to allocate a unique IP address to the MN.

This is a catch-22, right? How can the HA verify the authenticity of the
BU
without having a pre-established security association with the MN at a
certain
address? There is no way listed to establish some sort of authenticity
of the
NAI, unless I am totally missing something..

  Upon receiving a Binding Update, the HA MUST verify the 
  authenticity of the Binding Update message. The authentication
  process is out side the scope of this draft.

I disagree.

  If and when the HA receives a valid Binding Update with the
  Home IP address field set to zero and the NAI option included,
  it will attemnpt to allocate a unique IP address and 
  proceed with registration procedure as stated in [MIPV6].

So this means you are turning off all security?

I think I am not understanding the gist of the draft. Please explain how
security works in this scheme..

thanks,

TJ

-- 
        T.J. Kniveton 
   Communication Systems Lab
     Nokia Research Center

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6