Subject: [Mipshop] WG Consensus call on AAA based handover keys for FMIPv6

From: Vijay Devarapalli <[email-masked]>
Date: Sun, 22 Apr 2007 20:35:05 -0700

Hello folks,

Progressing FMIPv6 to Proposed Standard requires a mechanism to setup
security associations between the mobile node and the access router
dynamically. Currently our charter says we will develop two mechanisms
for this, one based on using Secure Neighbor Discovery between the
mobile node and the access router and one based on the AAA
infrastructure.

We have already adopted draft-ietf-mipshop-handover-key as a WG document
for the mechanism based on SeND. This is sufficient for advancing FMIPv6
as a proposed standard.

However, it is unknown whether SeND will always be available on access 
networks where FMIPv6 is likely to be deployed. At the same time a AAA
infrastructure is likely to be used in deployments where FMIPv6 is used.
So it would be good to develop a mechanism that leverages the AAA
infrastructure and sets up security associations between the mobile node
and the access router dynamically. Note that any mechanism we develop is
likely to require extensions to the AAA infrastructure/protocols to
support the handover keying mechanism.

So we would like to check if the WG still wants to develop a AAA based
handover keying mechanism for FMIPv6. So please reply to this email on 
whether you think such a mechanism needs to be developed by the MIPSHOP
WG. Please respond by April 30. This is a short one-week consensus call
since we need to re-charter pretty soon.

Note that this *NOT* a consensus call on adopting any particular draft.
That will follow once we decide to go ahead with this work item.

Chairs
MIPSHOP WG

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: Hannes Tschofenig <[email-masked]>
Date: Mon, 23 Apr 2007 09:50:01 +0200

Hi Vijay

I would like to understand all this procedure a bit better.

When the charter was created it called out for two mechanisms.

One was quickly turned into a working group document whereas the other 
is kept waiting
(even though we know that the AAA infrastructure will very likely be 
deployed in many, many networks).

Hence, I would like to get a better understanding why there is a need to 
repeatedly ask the group again and again where as other proposals 
progress quickly.
Are we then going to have another consensus call whether we want 
draft-vidya-mipshop-handover-keys-aaa (or the many other competing drafts)?
Maybe another one some time later to ensure that we really want it.
(I am not kidding here: That happened to me in one other working group...)

Ciao
Hannes

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 23 Apr 2007 01:08:31 -0700

Hi Hannes,

We have had people question the need for a new AAA based
keying mechanism being developed in the MIPSHOP WG. Some
have proposed scrapping this work item. So we need to know
if this work item still has strong support in the MIPSHOP
WG. Not just from a few vocal people.

> When the charter was created it called out for two mechanisms.

It is never too late to check if a particular work item
has support in the WG at any stage.

> draft-vidya-mipshop-handover-keys-aaa (or the many other competing drafts)?

There will be a separate consensus call again on adopting
draft-vidya-mipshop-handover-keys-aaa as a WG document.

Vijay

---

From: "Julien Bournelle" <[email-masked]>
Date: Mon, 23 Apr 2007 10:19:28 +0200

Hi Vijay, all,

 I think we need such a AAA-based mechanism.

 Regards,

 Julien

---

From: "Gerardo Giaretta" <[email-masked]>
Date: Mon, 23 Apr 2007 15:49:15 +0200

Hi Vijay and Stefano,

I think an AAA based handover keying mechanism for FMIPv6 is definitely needed.

In the past years we have worked on an AAA based solution for Mobile
IPv6 bootstrapping as everybody agreed that such a solution was needed
for MIPv6 deployment. The same solution developed for MIPv6 may be
applied also to HMIPv6. In DIME we are working on a Diameter
application for MIPv6 and any HMIPv6 related requirement will be
considered as well.

I don't see any reason why the same need does not apply to FMIPv6. The
SEND-based solution may be ok for infrastructure-less scenarios, but
it may be not enough for scenarios where operators want to explicitly
authorize and control the usage of network resources.

As mentioned by others, this item has always been in the charter and
was part of the charter discussion since the beginning (as a
requirement to publish FMIPv6 as PS). Note that even DIME charter
already includes an item for FMIPv6 so AAA work in DIME does not even
need any rechartering.

Regards,
Gerardo

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Mon, 23 Apr 2007 09:20:05 -0700

Can you point to some data on this? (Emails on the list, perhaps?)

Vidya 

> -----Original Message-----
> From: Vijay Devarapalli [mailto:[email-masked]] 
> Sent: Monday, April 23, 2007 1:09 AM
> To: Hannes Tschofenig
> Cc: [email-masked]
> Subject: Re: [Mipshop] WG Consensus call on AAA based 
> handover keys for FMIPv6
> 
> Hi Hannes,
> 
> keying mechanism being developed in the MIPSHOP WG. Some have 
> proposed scrapping this work item. So we need to know if this 
> work item still has strong support in the MIPSHOP WG. Not 
> just from a few vocal people.
> 
> Hannes Tschofenig wrote:
> > Hi Vijay
> > 
> It is never too late to check if a particular work item has 
> support in the WG at any stage.
> 
> > is kept waiting (even though we know that the AAA 
> infrastructure will 
> > very likely be deployed in many, many networks).
> > 
> > Hence, I would like to get a better understanding why there 
> is a need 
> > to repeatedly ask the group again and again where as other 
> proposals 
> > progress quickly.
> >> dynamically. Currently our charter says we will develop two 
> >> mechanisms for this, one based on using Secure Neighbor Discovery 
> >> between the mobile node and the access router and one based on the 
> >> AAA infrastructure.
> >>
> >> We have already adopted draft-ietf-mipshop-handover-key as a WG 
> >> document for the mechanism based on SeND. This is sufficient for 
> >> advancing FMIPv6 as a proposed standard.
> >>
> >> However, it is unknown whether SeND will always be available on 
> >> access networks where FMIPv6 is likely to be deployed. At the same 
> >> time a AAA infrastructure is likely to be used in 
> deployments where FMIPv6 is used.
> >> infrastructure and sets up security associations between 
> the mobile 
> >> node and the access router dynamically. Note that any mechanism we 
> >> develop is likely to require extensions to the AAA 
> >> infrastructure/protocols to support the handover keying mechanism.
> >>
> >> So we would like to check if the WG still wants to develop a AAA 
> >> based handover keying mechanism for FMIPv6. So please 
> reply to this 
> >> email on whether you think such a mechanism needs to be 
> developed by 
> >> the MIPSHOP WG. Please respond by April 30. This is a 
> short one-week 
> >> consensus call since we need to re-charter pretty soon.
> >>

---

From: Rajeev Koodli <[email-masked]>
Date: Mon, 23 Apr 2007 10:18:34 -0700

Hi Vijay,

> support the handover keying mechanism.

Right. The last sentence hints at a process issue?

> handover keying mechanism for FMIPv6.

Well, we have been operating under the assumption that there will be a
AAA-based protocol, no?

Anyway, I agree with the paragraph above and let's work on a solution.

Regards,

-Rajeev

> So please reply to this email on

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Mon, 23 Apr 2007 10:40:36 -0700

I share Hannes's thoughts. This consensus call, as any call that may be
issued yet again on draft-vidya-mipshop-handover-keys-aaa, has serious
procedural inconsistencies. 

In a consensus call issued on 3/22/06, the chairs asked for adoption of
6 drafts as WG items, including draft-vidya. There was pretty much equal
support to adopt all the drafts and some recommendations on a mobility
directorate review for 3 drafts: 

draft-vidya-mipshop-handover-keys-aaa
draft-kempf-mobopts-handover-key
draft-arkko-mipshop-cga-cba-03.txt

The chairs then decided (in an email to the list on 4/11/06) to delay
adoption of all those 3 drafts until after the MobDir review (the other
3 drafts were immediately adopted). A MobDir review of draft-vidya was
posted to the list on 5/29/06; one on draft-kempf was posted on 1/27/07
and no MobDir review was posted on draft-arkko (sorry if I missed it).
In addition, a security review on draft-vidya was also posted. All
review comments posted have been addressed in
draft-vidya-mipshop-handover-keys-aaa-04. 

Since then, all the 5 other drafts that were part of the original
consensus call have progressed (to varying degrees), while draft-vidya
has been held without explanation. We have discussed potential conflicts
between draft-ietf-mipshop-handover-key and RFC3972 that need to be
resolved before that is an acceptable solution to move FMIPv6 to a PS.
We need to discuss the implications of RFC3972 on that document on the
list and see what needs to be done, before stating something along the
lines of "We have already adopted draft-ietf-mipshop-handover-key as a
WG document for the mechanism based on SeND. This is sufficient for
advancing FMIPv6 as a proposed standard.", as the email from the chairs
presently states.  

All said and done, I find this process completely unacceptable and have
told the chairs that draft-vidya-mipshop-handover-keys-aaa is NOT a
candidate for consideration in a procedurally inconsistent environment
such as this one. 

Regards,
Vidya

> From: Hannes Tschofenig [mailto:[email-masked]] 
> Sent: Monday, April 23, 2007 12:50 AM
> To: Vijay Devarapalli
> Cc: [email-masked]
> One was quickly turned into a working group document whereas 
> the other is kept waiting (even though we know that the AAA 
> infrastructure will very likely be deployed in many, many networks).
> 
> is a need to repeatedly ask the group again and again where 
> as other proposals progress quickly.
> Are we then going to have another consensus call whether we 
> want draft-vidya-mipshop-handover-keys-aaa (or the many other 
> competing drafts)?
> mechanisms 
> > infrastructure and sets up security associations between the mobile 
> > whether you think such a mechanism needs to be developed by the 
> > MIPSHOP WG. Please respond by April 30. This is a short one-week

---

From: "James Kempf" <[email-masked]>
Date: Mon, 23 Apr 2007 11:15:01 -0700

Vidya,

>advancing FMIPv6 as a proposed standard.", as the email from the chairs

I think everyone, including Rajeev and myself who are co-authors on 
draft-ietf-mipshop-handover-key, agrees that we need to resolve any issues 
with RFC3972. I took a look at the minutes from the Prague meeting, and I 
could not make head nor tail of Lakshimanth's comments. I do not know if 
that was because the recorder couldn't understand what he was saying or was 
rather because the comments themselves were expressed in a way that made his 
point difficult to understand. We are now trying to get a clear statement of 
what Lakshimnath's concerns are, so that we can address them, and we will 
resolve the issue if there is one.

In addition, as Rajeev's email and my email here and in the past and my 
comments at the microphone during the San Diego meeting have supported, 
everyone is in agreement that we need to adopt an AAA based mechanism. As 
Vijay has stated, there is no harm in polling the WG periodically about 
whether there is still interest in doing a work item. This is, in fact, a 
good idea since it helps determine whether people have lost interest and 
therefore to weed out items that are not of interest (for example, the low 
latency work in MIP4 WG, which has lingered there for 5 years with gradually 
dwindling, and now zero, interest). I think from the response so far I 
believe that there is strong interest, and I hope draft-vidya will soon be 
submitted as a WG draft. I think this is independent of what is needed for 
advancing FMIP, as Vijay said, but that should not hold up acceptance of 
draft-vidya because people clearly want it.

Finally, I believe Vijay's email brought out the issue of whether there are 
any changes needed in the AAA infrastructure in order to support 
draft-vidya. Recall that such changes (though not large) were identified 
during the bootstrapping design work in MIPv6. So I think  it might be 
useful to consider what would be needed to make draft-vidya work well, and 
maybe come up with a list of requirements for the appropriate AAA WG if 
anything is found. Saying that no changes are needed in a misguided 
competition to somehow make the AAA based mechanism look as or more 
attractive than the SEND-based mechanism is really not helpful . Not that 
anybody has made this kind of statement (yet). :-)

I think the goal of standardizing draft-vidya for an AAA based mechanism 
should be to ensure that there is a well-designed AAA based mechanism that 
covers all the security issues, with recommended changes to the AAA 
infrastructure if necessary.

                      jak

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Mon, 23 Apr 2007 11:39:57 -0700

Hi James, all,
I don't intend spending much more time on this debate - I'll stop with
noting a few points below. 

> From: James Kempf [mailto:[email-masked]] 
> Sent: Monday, April 23, 2007 11:15 AM
> To: Narayanan, Vidya; Hannes Tschofenig; Vijay Devarapalli
> Cc: [email-masked]
> >has been held without explanation. We have discussed potential 
> >conflicts between draft-ietf-mipshop-handover-key and 
> RFC3972 that need 
> >to be resolved before that is an acceptable solution to move 
> FMIPv6 to a PS.
> I think everyone, including Rajeev and myself who are 
> co-authors on draft-ietf-mipshop-handover-key, agrees that we 
> need to resolve any issues with RFC3972. I took a look at the 
> minutes from the Prague meeting, and I could not make head 
> nor tail of Lakshimanth's comments. I do not know if that was 
> because the recorder couldn't understand what he was saying 
> or was rather because the comments themselves were expressed 
> in a way that made his point difficult to understand. We are 
> now trying to get a clear statement of what Lakshimnath's 
> concerns are, so that we can address them, and we will 

As you know, we've had some offline discussion and have some input from
Tuomas as well on RFC3972 guidelines - I was noting that we need to have
that discussion and conclude. Anyway, this was not the main point of my
email. 

> In addition, as Rajeev's email and my email here and in the 
> past and my comments at the microphone during the San Diego 
> meeting have supported, everyone is in agreement that we need 
> to adopt an AAA based mechanism. As Vijay has stated, there 
> is no harm in polling the WG periodically about whether there 
> is still interest in doing a work item. This is, in fact, a 
> good idea since it helps determine whether people have lost 
> interest and therefore to weed out items that are not of 
> interest (for example, the low latency work in MIP4 WG, which 
> has lingered there for 5 years with gradually dwindling, and 
> now zero, interest). I think from the response so far I 
> believe that there is strong interest, and I hope draft-vidya 
> will soon be submitted as a WG draft. I think this is 
> independent of what is needed for advancing FMIP, as Vijay 
> said, but that should not hold up acceptance of draft-vidya 
> because people clearly want it.
> 

I was trying to point out the inconsistency in handling a single
document among the 5 other documents that were part of the same
consensus call. No reason has really been given for holding up
draft-vidya subsequent to the consensus call - I simply don't understand
why it was not adopted just like the other drafts, after completion of
reviews and necessary updates, when one of the drafts was adopted even
without the necessary MobDir review! 

> Finally, I believe Vijay's email brought out the issue of 
> whether there are any changes needed in the AAA 
> infrastructure in order to support draft-vidya. Recall that 
> such changes (though not large) were identified during the 
> bootstrapping design work in MIPv6. So I think  it might be 
> useful to consider what would be needed to make draft-vidya 
> work well, and maybe come up with a list of requirements for 
> the appropriate AAA WG if anything is found. Saying that no 
> changes are needed in a misguided competition to somehow make 
> the AAA based mechanism look as or more attractive than the 
> SEND-based mechanism is really not helpful . Not that anybody 
> has made this kind of statement (yet). :-)
> 

Nobody has claimed that no changes are needed to the AAA infrastructure.
It is known that we need new attributes and we've even had appendices in
our draft to show that - the appendices were only recently removed,
since those are supposed to be separate documents anyway (and all
reviews asked for removal of those). But, a AAA-based scheme requiring
changes to AAA infrastructure to support additional attributes/AVPs is
not new. 

Vidya

> I think the goal of standardizing draft-vidya for an AAA 
> based mechanism should be to ensure that there is a 
> well-designed AAA based mechanism that covers all the 
> security issues, with recommended changes to the AAA

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 23 Apr 2007 17:25:55 -0700

> Can you point to some data on this? (Emails on the list, perhaps?)

There were no emails sent to the list.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 23 Apr 2007 20:27:12 -0700

Folks,

Please reply to the consensus call. Do not discuss
draft-vidya-mipshop-handover-keys-aaa on this thread.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 23 Apr 2007 20:30:51 -0700

James Kempf wrote:
> draft-ietf-mipshop-handover-key, agrees that we need to resolve any 
> issues with RFC3972. I took a look at the minutes from the Prague 
> meeting, and I could not make head nor tail of Lakshimanth's comments. I 
> do not know if that was because the recorder couldn't understand what he 
> was saying or was rather because the comments themselves were expressed 
> in a way that made his point difficult to understand. We are now trying 
> to get a clear statement of what Lakshimnath's concerns are, so that we 
> can address them, and we will resolve the issue if there is one.
> 
> everyone is in agreement that we need to adopt an AAA based mechanism. 
> As Vijay has stated, there is no harm in polling the WG periodically 
> about whether there is still interest in doing a work item. This is, in 
> fact, a good idea since it helps determine whether people have lost 
> interest and therefore to weed out items that are not of interest (for 
> example, the low latency work in MIP4 WG, which has lingered there for 5 
> years with gradually dwindling, and now zero, interest). I think from 
> the response so far I believe that there is strong interest, and I hope 
> draft-vidya will soon be submitted as a WG draft. I think this is 
> independent of what is needed for advancing FMIP, as Vijay said, but 
> that should not hold up acceptance of draft-vidya because people clearly 
> want it.
> 
> Finally, I believe Vijay's email brought out the issue of whether there 
> are any changes needed in the AAA infrastructure in order to support 
> useful to consider what would be needed to make draft-vidya work well, 
> and maybe come up with a list of requirements for the appropriate AAA WG 
> if anything is found. Saying that no changes are needed in a misguided 
> attractive than the SEND-based mechanism is really not helpful . Not 
> that anybody has made this kind of statement (yet). :-)
> 
> should be to ensure that there is a well-designed AAA based mechanism 
> that covers all the security issues, with recommended changes to the AAA 

Thank you. :)

But seriously I would rather see a document gathering WG support
rather than saying it should go ahead because there is no one
objecting.

Vijay