Subject: [mobile-ip] Main Mode (Phase 1 of ISAKMP) and Mobile IPv6

From: "Gaurav Puri" <[email-masked]>
Date: Mon, 10 Mar 2003 11:29:55 +0530

hi,
    it is a requirement of mobile IP  that the source address of ISAKMP
packets is Careof address when IKE is initiated by MN at foreign network.
 Consider IKE Phase 1 Authenticated With Signatures:-
        Initiator                          Responder
       -----------                        -----------
        HDR, SA                     -->
                                    <--    HDR, SA
        HDR, KE, Ni                 -->
                                    <--    HDR, KE, Nr
        HDR*, IDii, [ CERT, ] SIG_I -->
                                    <--    HDR*, IDir, [ CERT, ] SIG_R
   if we implement this using Main mode, we have to maintain/store the
information about the messages exchanged(like nonce values and keying
information etc)  b/w MN and HA till the ID of MN is revealed(i.e the 5th
message).

this information has to be maintained regardless of the authenticity of the
initiator. the sender can be authenticated only after the 5th message.
Isn't it a severe security threat?? HA can be flooded with fake
messages....

please clarify

regards
  gaurav

---

From: "Warodom Werapun" <[email-masked]>
Date: Mon, 10 Mar 2003 17:19:38 +0700

Following this link:

http://www.ietf.org/internet-drafts/draft-jeong-hmipv6-dns-optimization-00.t
xt

When mobile node move, we only map to new DNS server.
We can reach mobile node in new location by using name in DNS.
So, we don't need to set up any Home agent, are we?

/Warodom

Ps: I'm so newbies in MIPv6.
    Thank you for your reply.

---

From: Francis Dupont <[email-masked]>
Date: Mon, 10 Mar 2003 14:00:03 +0100

=> this is an issue for IPsec which is not bound to Mobile IP,
i.e., this mailing list is not the right one.

Regards

[email-masked]

PS: BTW this problem was discussed in the IPsec WG and proper
implementations can't be so easily DoS-ed. Look at sections 2.6 or
2.12 of draft-ietf-ipsec-ikev2-05.txt for instance.

---

From: "Jaehoon Jeong" <[email-masked]>
Date: Thu, 13 Mar 2003 11:56:16 +0900

[mobile-ip] MobileIPv6 VS DNSHello, I am the author of this draft.
http://www.ietf.org/internet-drafts/draft-jeong-hmipv6-dns-optimization-00.txt 
(Title : The Autoconfiguration of Recursive DNS Server and 
 the Optimization of DNS Name Resolution in Hierarchical Mobile IPv6)
This draft is one of RA-based DNS discovery solutions.

>----- Original Message ----- 
>From: Warodom Werapun 
>To: [email-masked] 
>Sent: Monday, March 10, 2003 7:19 PM
>Subject: [mobile-ip] MobileIPv6 VS DNS

>Following this link: 
>http://www.ietf.org/internet-drafts/draft-jeong-hmipv6-dns-optimization-00.txt 

  When mobile node moves into another MAP domain in hierarchical mobile IPv6 network, 
  it needs to find a new recursive DNS server  for the optimization of DNS resolution process 
  in the respect of name resolution time.

>We can reach mobile node in new location by using name in DNS. 

  Yes, your're right. But when a mobile node tries to connect to an Internet service, such as web server,
  first of all, it should resolve the service's DNS name into IP address.
  In current DNS operation, the mobile node uses a fixed recursive DNS server normally placed in its home network.
  If the mobile node can find a new recursive DNS server in the visited network, 
  it can use the new one for DNS name resolution instead of the previous one.
  In the result, the time for name resolution can be saved. This is the main object of this draft.
  I think the idea of the draft can be applied to IPv6 or mobile IPv6 network as well as hierarchical mobile IPv6 network.

>  Thank you for your reply. 

Thanks for your question.

Regards,
Jaehoon