Subject: RE: [mobile-ip] Sub: Identifying link changes

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Thu, 20 Jun 2002 17:42:22 +0200

=> So is the approach to not mention what mechanisms
should be used (for the 'on-the-fly' case) and leave
it FFS?
Because the preconfigured cases are probably not 
likely to exist. So I'm wondering whether we should keep it.

Hesham

---

From: Jari Arkko <[email-masked]>
Date: Thu, 20 Jun 2002 19:46:44 +0300

Hesham Soliman (ERA) wrote:

>   > > Do we know how to secure a BU to a random AR?
>   > > Is the assumption that we will use RR for this?
>   > 
>   > 
>   > The spec says the temporary HA should be treated as
>   > a regular HA. In other words, either you have security
>   > associations, can establish them on the fly, or you
>   > don't do this.
> 

I believe the assumption has been that you could use the
same mechanisms as for MN-HA security, i.e. IPsec. If
manual keying is out of the question, you could use IKE
to establish SAs. I'd be interested in seeing the necessary
SPD entries to find out if there's anything unexpected.
Has someone implemented forwarding-from-previous-coa, with
security?

Jari

---

From: "James Kempf" <[email-masked]>
Date: Thu, 20 Jun 2002 10:30:17 -0700

> Has someone implemented forwarding-from-previous-coa, with

Since the AR is, after all, a router, doesn't this have some connection
with the SEND BOF? That is, if general Neighbor Discovery is secured in
some way that has security properties equivalent to an IPsec security
association (perhaps it even is an IPsec SA), then couldn't that be
leveraged for "on link HA" security?

            jak

---

From: Jari Arkko <[email-masked]>
Date: Thu, 20 Jun 2002 21:53:56 +0300

> leveraged for "on link HA" security?

Answer #1: No, because while on link we don't need the security and when
we do, we are no longer on link. (The on-link previous coa is kind of a
special case.)

Answer #2: OTOH, some SEND schemes could probably be applied here. Say,
if we end up with an IPsec SA based on something, or verify the CGA
property of the local router, we could use the same keys later to establish
an on-the-fly SA from another location back to this HA.

Jari

---

From: "Alper E. YEGIN" <[email-masked]>
Date: Thu, 20 Jun 2002 15:30:07 -0700

> an on-the-fly SA from another location back to this HA.

This is clearly different discussion than the original e-mail that
started the thread. Nevertheless...

I agree that an access router that performs forwarding from
previous care-of address should be treated just like a Home Agent.
(actually, now it is a home agent when we start using the old CoA as MN's
home address). Therefore IPsec should be used for securing BUs.

And this requires a security association between the MN and this particular
AR. If the MN had this pre-configured (just like we assume for the root
Home Agent), then there is no problem. If MN doesn't have this SA
pre-configured, or it cannot dynamically create one, then it cannot use
forwarding from previous care-of address with that particular AR. Simple...

And as for creating this SA dynamically,  one can rely on bootstraping
using link-layer authentication (not favorable), or network layer
authentication
(e.g., PANA), or some infrastructureless method. This part of the problem is
equivalent to what SEND has to do for building a SA to secure neighbor
discovery between MN(host) and AR (router). I think this SA must be built
while MN is still connected to the AR, not after it disconnected.

my 0.02 cents.

alper

---

From: "James Kempf" <[email-masked]>
Date: Fri, 21 Jun 2002 09:14:25 -0700

> we do, we are no longer on link. (The on-link previous coa is kind of
a

I guess I don't understand this response. Suppose, for the sake of
argument (but yet to be established if it is technicallly realistic) an
IPsec SA is set up to secure ND. My understanding is that the SA is
bidirectional, and identifies the hosts involved by their IP address
and, optionally, port number if a particular protocol is being protocted
(this wouldn't apply to ICMP however). Since the host will maintain the
old CoA when it moves to the new link (that is, after all, the problem
that forwarding from previous care of address is trying to solve), then
wouldn't this be sufficient to maintain the security association?

> an on-the-fly SA from another location back to this HA.

Setting up a new SA sounds pretty time consuming. Some people want to
use forwarding from previous care of address for fast handover, and I
believe there are currently commercial products which use forwarding
from previous foreign agent for that purpose in MIPv4. Presumably, there
would be some interest to continue doing so for MIPv6.

            jak