Subject: [Mip6] RE: review of draft-ietf-mip6-bootstrapping-split-00.txt

From: Gerardo Giaretta <[email-masked]>
Date: Wed, 28 Sep 2005 15:50:27 +0200

Hi Jari,

sorry for my late reply. One question below.

> Gerardo Giaretta wrote:
> 
> >>One potential issue (and this is also an issue in [6]) is
> >>that the identity given in EAP-based authentication
> >>is not necessarily something that you can tie a long-term
> >>home address identity to. For instance, the identity
> >>could be a pseudonym (e.g. EAP-SIM), or a privacy NAI (e.g.
> >>RFC2486bis). 
> >>    
> >>
> >
> >I see the issue. I guess the same issue applies to VPN that 
> makes use of
> >IKEv2-EAP. How is it handled in that case? Since the AAA server knows
> >the long-term identity of the MN, maybe the AAA server may have an
> >active role to create the matching between the identity and the HoA.
> >  
> >
> Well, there may be AAA ways of communicating this to
> the home agent/vpn gateway, such as the use of the
> Chargeable-User-Identity attribute, or some IP address
> attributes. Some work would be need to study whether
> those are sufficient or if something else is needed, and
> in case all this would have to be documented somewhere
> so that implementors would know what to do.
>

I see. These ways seem to be related to the AAA beack end communication
that is not the focus of this draft. AAA back end goals will be updated
in draft-ietf-mip6-aaa-ha-goals.
Do you think more text is needed in this draft on this issue?

--Gerardo

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Gerardo Giaretta <[email-masked]>
Date: Thu, 29 Sep 2005 18:52:57 +0200

This is the draft Kilian proposed for location privacy: http://www.ietf.org/internet-drafts/draft-weniger-rota-00.txt 

--Gerardo 

> -----Original Message-----
> From: James Kempf [mailto:[email-masked]] 
> Sent: giovedì 29 settembre 2005 17.58
> To: Gerardo Giaretta; Vijay Devarapalli; Kilian Weniger
> Cc: [email-masked]
> Subject: Re: [Mip6] review of 
> draft-ietf-mip6-bootstrapping-split-00.txt
> 
> OK, I'll see if I can come up with some text. Can you send a 
> reference to 
> Kilian's draft?
> 
>             jak
> 
> ----- Original Message ----- 
> From: "Gerardo Giaretta" <[email-masked]>
> To: "Vijay Devarapalli" <[email-masked]>; "Kilian Weniger" 
> <[email-masked]>
> Cc: <[email-masked]>
> Sent: Thursday, September 29, 2005 2:14 AM
> Subject: RE: [Mip6] review of 
> draft-ietf-mip6-bootstrapping-split-00.txt
> 
> 
> 
> 
> > > If my understanding is correct, I think it might be good to
> > have some
> > > text about that in draft-ietf-mip6-bootstrapping-split-00.txt,
> > > especially because location privacy and routing efficiency
> > is mentioned
> > > in draft-ietf-mip6-bootstrap-ps-03.txt as a motiviation for the
> > > bootstrapping solution.
> >
> > I think I understand your point now. if the MN acquires a local
> > HA and HoA and the MN's DNS entry is updated with the local HoA,
> > then this reveals where the MN is located. there isn't much we
> > can do here. maybe just point this out, as Jim recommended, in
> > the Security Considerations section. (somebody a while ago
> > suggested adding location privacy considerations section to
> > every draft :)
> >
> 
> Agree that there is not much we can do here. Specific solutions to the
> location privacy problem (as the one Kilian pointed out) may be useful
> in this scenario, but I think this is not in the scope of the
> bootstrapping draft. We'll provide some text in Sec Cons section to
> address this issue, as James suggested.
> 
> --Gerardo
> 
> > Vijay
> >
> > >
> > > Kilian
> > >
> > >
> > >>>An alternative solution to this problem is to reverse
> > >>
> > >>tunnel to local
> > >>
> > >>>HAs, but keep the HoA of MN unchanged. This approach is,
> > >>
> > >>e.g., proposed
> > >>
> > >>>in draft-weniger-rota-00.txt.
> > >>>
> > >>>BTW, shouldn't the QNAME be set to "_mip6_ipv6.example.com"
> > >>
> > >>instead of
> > >>
> > >>>"mip6.example.com" in the DNS lookup by service name
> > >>
> > >>example in section
> > >>
> > >>>5.1.2 of draft-ietf-mip6-bootstrapping-split-00.txt?
> > >>
> > >>yes.
> > >>
> > >>Vijay
> > >>
> > >>
> > >
> > >
> >
> >
> >