Subject: RE: [Mip6] use of IPsec

From: "Soliman Hesham" <[email-masked]>
Date: Wed, 5 May 2004 12:32:26 -0400

> The first reason that IPsec was denigrated was because of 
 > the structure of
 > the Binding Update.  The IPsec experts claimed that one 
 > could not use the
 > destination option number as a selector for a security association.

=> That's true, but at the same time it's easy to fix that.
A new header can be defined, as we did eventually.

 > 
 > The second reason was that the area directors insisted on a scalable
 > solution for binding updates with arbitrary correspondent nodes, but
 > historically that was secondary.  And, as we have seen, it would have
 > been better anyway to pursue that later; even now it is burdensome to
 > have the return routability in the same document as the base 
 > specification.
 > So, scalability was at once mandated and yet not possible at 
 > that time
 > with any known mechanisms.

=> I always thought of this as the major reason. Frankly I never
took the first reason seriusly because the fix was trivial.

 > 
 > The other points were raised afterwards, historically speaking.
 > And, try as I might, I can't get bent out of shape about the address
 > ownership problem anyway, so I would very much object to
 > making that anywhere near the "major" reason.  I've never heard
 > of any threats outside the realm of thought experiments involving
 > applications with weird properties.

=> Hmmm, I guess we'll just agree to disagree about this one.
I think address ownership is an important issue. It's not the 
major reason for not using IPsec. In my mind, the major reason
is the lack of global PKI. After all we use IPsec with the HA
and it works fine.

Hesham

========================================================
This email may contain confidential and privileged material for the sole
use of the intended recipient.  Any review or distribution by others is 
strictly prohibited.  If you are not the intended recipient please contact
the sender and delete all copies.
========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: "Charles E.Perkins" <[email-masked]>
Date: Wed, 05 May 2004 10:59:19 -0700

Hello Hesham,

Soliman Hesham wrote:

>> the structure of the Binding Update.  The IPsec experts
>> claimed that one could not use the destination option
>> number as a selector for a security association.
> 

It's easy in hindsight, especially if one disregards the
other features that were deleted as collateral damage.

>> specification.  So, scalability was at once mandated and yet not
>> possible at that time with any known mechanisms.
> 
> => I always thought of this as the major reason.

O.K.  I am guessing we have consensus on this, then.

>    major reason for not using IPsec.

Well, I'm easy on this.  Please exhibit the threat by way of
some rational application (e.g., VoIP).  As I understand it,
the application running on the correspondent node has to have
certain characteristics:
1) no feedback from the mobile node
2) agrees to accept bazillions of incoming packets
   regardless of (1)

Or we can try to justify by way of the distributed
denial of service attack, whereby bazillions of
devices in the Internet attempt to use a sophisticated
Mobile IPv6 mechanism instead of just bombing the heck
out of the victim with pings...  (?)

>                            In my mind, the major reason

Yow.  Global PKI.  It sounded a lot better before
we had John Ashcroft.

Regards,
Charlie P.

---

From: "Charles E.Perkins" <[email-masked]>
Date: Wed, 05 May 2004 11:39:58 -0700

Hello again Hesham,

I typed something in error in my previous e-mail,
please allow me to correct.  Where I previously
typed:

>                                       As I understand it,

I should have typed:

>                                      As I understand it,
> 1) no feedback from the victim node
> 2) agrees to produce bazillions of incoming packets
>    regardless of (1)

since, once the malicious mobile node has done its
deed to victimize a care-of address, it's no longer
in the picture necessarily.

Regards,
Charlie P.

---

From: Francis Dupont <[email-masked]>
Date: Wed, 05 May 2004 23:09:08 +0200

In your previous mail you wrote:

   >>The IPsec experts

=> rfc2401bis should reopen the door to extension headers as
traffic selectors so the whole thing is not yet closed.

   
=> IMHO this is the right argument to not make IPsec the default
protection mechanism for the MN - random CN case. We don't need
more, in particular personal opinions based on dubious technical
assumptions.

=> I strongly agree: I still argue that without ingress filtering
one is already dead with or without Mobile IPv6 mechanism.
This issue seems to be mainly FUD.

   > is the lack of global PKI. After all we use IPsec with the HA
   
   Yow.  Global PKI.

=> the question is not whether a global PKI is good or bad (?),
it is whether it is or will soon be available. As the answer is
*no* the argument is at least valid.

   It sounded a lot better before we had John Ashcroft.
   
=> this seems to be a "domestic" statement (:-).

Thanks

[email-masked]