Subject: [mobile-ip] BU AltSec BAR BOF Report

From: "James Kempf" <[email-masked]>
Date: Mon, 15 Jul 2002 18:39:21 -0700

These are some notes on the BAR BOF held last night on alternate BU security
mechanisms. There were 18 people in attendance.

Currently, there are three alternative mechanisms that are under consideration.
The list below is ordered by need for infrastructure (least infrastructure
first):

    - Cryptographically Generated Addresses
    - Address Based Keys
    - AAA

We also discussed a couple simple optimizations of Return Routability, like
substituting for the Home Address Cookie, that would improve the performance but
still maintain the basic algorithm.

The group agreed that the primary requirement for any new algorithm is that it
should improve on the Return Routability performance by cutting down on the
number of messages involved in doing Route Optimization.

Secondarily, improvement in the very few security areas where Return Routability
still has vulnerabilities would also be of interest.

An important consideration for any algorithm is that it prevent selective
bombing attacks, where a node can launch a DoS attack through a third party. The
CoTI/CoT exchange is designed to prevent this. Any algorithm which doesn't
prevent selective bombing attacks should be excluded. Bombing attacks on
networks were also discussed, since CGA won't prevent them, but they were
thought to be of a lesser concern.

We talked briefly about how to proceed with standardization work in this area,
and all agreed that it should proceed through the MIP group, since the
expertiese and interest is there. Starting a mailing list was suggested, but by
IETF procedure, any discussion would have to proceed through the MIP list.

                jak

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 16 Jul 2002 16:10:02 +0200 (CEST)

> substituting for the Home Address Cookie, that would improve the performance
> but still maintain the basic algorithm.

I think a word is missing above. Substituting what for the HA cookie?

  Erik

---

From: "James Kempf" <[email-masked]>
Date: Tue, 16 Jul 2002 15:07:46 -0700

> I think a word is missing above. Substituting what for the HA cookie?

Tuomas made this suggestion. He did not elaborate on it at the time. Perhaps he
could elaborate now?

            jak

---

From: Jari Arkko <[email-masked]>
Date: Fri, 26 Jul 2002 14:43:46 +0300

>>I think a word is missing above. Substituting what for the HA cookie?

I can't remember exactly the specific comment. But I think this is
related to the ability of e.g. CGA to skip home address tests at least
for the majority of movements. It seems some form of care-of address
tests will be necessary always, even if some optimizations might perhaps
be possible even there.

Jari