Subject: Re: [mobile-ip] closing the sol/adv security issue

From: "T.J. Kniveton" <[email-masked]>
Date: Sun, 30 Jun 2002 23:58:56 -0700

> From: Jari Arkko <[email-masked]>

> Also, we have discussed whether protecting ICMPv6 would cause
> additional problems. I don't think it will -- if a packet
> matches the SPD entry it will be protected to the home agent. If
> not it, it will be sent in the clear. Either way, the HA will
> get even ICMP errors and other messages. A separate SA should
> be used for MH and ICMPv6.
> 
> We have also discussed whether to use MH or ICMPv6 for the messages.
> My proposal is that we stick to the current approach, i.e. ICMPv6 to avoid
> too much document (and implementation) change.
> 
> So here's a proposal on how to move forward:
> 
> 1. Keep the current messages and functionality.
> 2. Require that all sol/adv messages be protected.
> 3. Document the fact that the mobile nodes can have
> some home address to begin with, and must in any case
> have SA(s).
> 
> Ok?

I agree with your conclusions. As long as you're confident that it won't be
a big burden to secure ICMPv6, then it seems reasonable to me to leave
things as-is and require protection (and hence an existing HoA).

-TJ

---

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Mon, 1 Jul 2002 13:40:53 +0200

Jari, 

This is fine with me. 

Hesham

  > -----Original Message-----
  > From: Jari Arkko [mailto:[email-masked]]
  > Sent: Friday, June 28, 2002 10:10 PM
  > To: [email-masked]'
  > Subject: [mobile-ip] closing the sol/adv security issue
  > 
  > 
  > Folks,
  > 
  > We need to close this issue and move on.
  > 
  > Over the course of the discussion a number of observations and
  > comments have been made. There seems to be some amount of 
  > disagreement
  > about the level of security needed. We have also debated the
  > order of events, the specific protocol that should carry
  > the discovery messages, what information the MNs need to have
  > at startup anyway, and so on.
  > 
  > How to agree then? Given disagreement about the security level,
  > perhaps it would be easiest to accept the tougher requirements.
  > 
  > The question is, does this cause problems for us?
  > Fortunately, this does appear to be so. As has been discussed,
  > an SA and a potential home address is available in any case
  > for the MN, so perhaps these could be used.
  > 
  > Jari