Subject: RE: [mobile-ip] A threat RR doesn't solve and that doesn't seem t o exist in IPv4

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 29 Jan 2002 16:29:16 +0100

Erik wrote:

  > I guess there is an open question for localized mobility 
  > management around
  > trust issues, threat models, etc that may or may not result 
  > in a need
  > for a *local* RR check e.g. involving the previous AR, new 
  > AR, and MN.
  > But that's just utter speculation on my behalf at this 
  > point in time.

=> I think this is true. I think LMM/FMIP schemes 
would require some stronger form of security due 
to the large impact of the security breach
(switching all packets off for the MN !). 

Since these mechanisms were designed to speed
up handovers and reduce signalling, it would 
make sense IMHO to have a solution that will
be 'secure enough' to allow for a BSA. For example, 
a MN can have a BSA with a MAP so movement 
only results in one BU being sent. The same 
goes for the MN - old AR relationship, a 
BSA + Context transfer would reduce the time 
required for a MN to establish an SA and 
hence speed the IP handover. 

This is one of the reasons I'm in favour of 
a solution that allows for a BSA. If we have it, 
we wouldn't need to go through this work next 
time round. 

The price for that solution is certainly an 
important consideration, but maybe having optional
optimisations (like CGA) from day one could 
solve this. 

I think the lack of 'fast handovers' for MIP 
can affect its deployment to a large extent. 
Sorry for the pessimism but people continue to
claim the MIP as it is, is not fast enough :(
I think we can prove that wrong, or at least
try. 

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Tue, 29 Jan 2002 09:13:23 -0800

Hesham,

> optimisations (like CGA) from day one could 

I have not yet made up my mind whether CGA
or RR is a better solution, as I am waiting for
the design team's report. However, one possibility
that has me leaning in the direction of CGAs is
the applicability to other problems in mobile
computing, like, possibly, IP paging security.

> I think we can prove that wrong, or at least

Here we agree. It is most unfortunate,
but probably inevitable, that
the WG seems only able to concentrate
on one problem at a time. The focus on
security for MIPv6 seems to be
excluding all but peripheral discussion on
other issues. While I agree that it is
the top priority, I wish we could get more
attention to fast handovers.

            jak