Subject: RE: ro-sec-00.txt & ipsec in 3.5 (Was: Re: [Mip6] Template for raising issues w.r.t WG documents)

From: "Soliman Hesham" <[email-masked]>
Date: Wed, 5 May 2004 09:14:35 -0400

Hi Jari, 

I didn't see this before I generated my own subject ;)
a comment below.

 > >   - the first reason is completely wrong IMHO. One can 
 > argue that IPsec
 > >     has its own DoS issues but this is not what I can read 
 > here. Do authors
 > >     really believe that the strong mutual authentication 
 > required/used by
 > >     IPsec is weaker than return routability check?
 > 
 > I don't like the current text either. It talks about DoS attacks
 > in a way that can be interpreted in the wrong way. OTOH, I don't
 > agree with you above either, when you say that strong mutual
 > authentication is better than RR. The problem with strong mutual
 > authentication is that it does not address the authorization
 > issue (except perhaps in limited cases, and certainly not in
 > a scalable way). 

=> IMHO the real problem is the scalability, lack of global
PKI. If that existed, authorisation for the HoA and CoA
would have been possible. For the CoA it's trivial, a simple
reachability check will do. For the HoA it is possible
to add the HoA to the certificate, especially if it comes
from the ISP running the HA. I know this is not ideal, but
it's certainly a far cry from "impossible" as stated in the
text. It's a workable soultion if global PKI was here, so
we go back to the root of the problem.

   But perhaps its easy for us to find agreement
 > by expanding a bit the scalability reason. For instance, we
 > can state the requirements, such as being able to show some
 > form of "address ownership", and mention the problems in getting
 > something IPsec and certificates to provide that in a large
 > scale, even if your laptop and home server could be set up
 > this way.

=> Yes that seems reasonable.

Hesham

========================================================
This email may contain confidential and privileged material for the sole
use of the intended recipient.  Any review or distribution by others is 
strictly prohibited.  If you are not the intended recipient please contact
the sender and delete all copies.
========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: "Jean-Michel COMBES" <[email-masked]>
Date: Wed, 5 May 2004 15:33:30 +0200

> -----Message d'origine-----
> De : [email-masked] [mailto:[email-masked]]De la part de
> Soliman Hesham
> Envoyé : mercredi 5 mai 2004 15:15
> À : Jari Arkko; Francis Dupont
> Cc : [email-masked]
> Objet : RE: ro-sec-00.txt & ipsec in 3.5 (Was: Re: [Mip6] Template for
> raising issues w.r.t WG documents)
>
>
> Hi Jari,
>

* "operator hat" on *

and in some cases, we have such a "PKI" (AAA based, DNSSEC based or
classical PKI)

* "operator hat" off *

> => Yes that seems reasonable.

JMC.

France Telecom R&D - DTL/SSR
Jean-Michel COMBES, Internet/Intranet Security
E-Mail : [email-masked]
Phone +33 (0)1 45 29 45 94, Fax +33 (0)1 45 29 65 19