Subject: RE: [mobile-ip] Issue 49 (rfc 3041 or new prefixes and manual SAs )

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Mon, 1 Jul 2002 17:10:21 +0200

Jari, 

  > And more issues to close...
  > 
  > I've had a discussion about this issue with a couple of people.
  > The general feeling seems to be that making mobility work with
  > privacy in a seamless and secure way may not be achievable
  > right now. Or rather, it shouldn't be a requirement for the
  > first version of the MIPv6 RFC.
  > 
  > Let me highlight some of the issues involved in this:
  > 
  > * On manually keyed IPsec SAs we have the problem of binding
  >    the SAs to the IP addresses, leading to a need for manual
  >    intervention when addresses change.

=> Agreed.

  > 
  > * Security schemes that are not directly bound to addresses
  >    could also be used. But even these schemes have to deal
  >    with a few non-trivial questions, such as who has the
  >    authority to send a BU for a specific address to the HA?
  >    The very first authenticated MN to come up with that address?
  >    But then we'd have to store all addresses that have ever
  >    been used. Or perhaps we could allow the address to be
  >    used if no one else has a binding for it at the moment, or
  >    DAD succeeds? But what if I hijack everyone else's addresses
  >    after the HA reboots?

=> Well, I agree, with one clarification: I believe
that anyone can send a BU for any home address provided:

1. No binding exists for that address and
2. That address is not stored in a server to be 
used as a permanent identifier for another
MN. 
(1) is easy to check, but (2) is slightly harder. 

  > 
  > * On certificate-based IPsec, one can use addresses in the
  >    Subject AltName field to force the HA to allow only the
  >    given address for the owner of that certificate. This
  >    would minimize configuration at the HA, but would bind
  >    every MN to their given addresses.
  > 
  > * For renumbering, it is conceivable that the HA/CA
  >    could make new certificates for the same MN/public key
  >    but with the new address. But isn't clear how these
  >    are pushed to the MNs in the easiest manner.
  > 
  > * For RFC 3041, the problem is harder because the MN
  >    has the initiative. Perhaps the MN could request
  >    a new SA/cert using its old address/SA/cert.
  > 
  > Solving all of the above may not be possible in the immediate
  > future and definately not before Monday 9 AM.
  > 
  > So, I have the following proposal:
  > 
  > - We keep on allowing RFC 3041 home addresses and new prefixes.
  > - We point out that in order to use these, one must have e.g.
  >    manually configured SAs suitable for the new addresses.
  > - We point out that future specifications will deal with this
  >    problem in a more complete manner.
  > 
  > Does this work for everyone?

=> Works for me.

Hesham