Subject: RE: Revising the Spec (was :Re: [mobile-ip] FMIPv6: Sending FBU from the new link)

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 13 Mar 2003 12:05:35 -0800

> 
> 
> > > The SA is the issue. What is it? How is it set up?
> > >
> > An IPsec SA established at boot up.
> >
> 
> With the AR? How does it get to the next AR on handover? 
> Context transfer (==
> dependency on Seamoby)? AAA (= dependency on AAA)? Or is it 
> re-established from
> scratch  (== time consuming)?
> 
I was replying to a different point of yours which i probably misunderstood.
You said "ttl 255 filtering rule of rfc2461 makes sure the FBU could not
have come from anywhere else except on-link". I replied that the same can be achieved by
accepting BUs only from the wireless side or from other ARs in the same domain
with which you already have a pre-established SA.

But, the above message talks about the FBU protection itself (MN - oAR) whose
details are unknown at this point. Yes, this is an issue that needs resolution
and i agree with you on this.

thanks
mohan

>             jak

---

From: Rajeev Koodli <[email-masked]>
Date: Thu, 13 Mar 2003 14:22:47 -0800

> and i agree with you on this.

I agree the last paragrpah is readily relevant for us. Folks, keep the
focus on how the FBU can be protected. It seems that we ought to be
able to use the SA that was established while the MN was on old link.
I don't think the issue for FMIPv6 is about establishing SA with the
new router (or any router), is it ?

---

From: "James Kempf" <[email-masked]>
Date: Thu, 13 Mar 2003 15:01:33 -0800

> new router (or any router), is it ?

Well, I think it is.

The new rule is: no more IPsec pixie dust. If a protocol specifies that a
security association is to be established, then it had better either point to a
spec that describes how or contain text that does.

The ADs can correct me if I'm wrong.

            jak

---

From: Rajeev Koodli <[email-masked]>
Date: Thu, 13 Mar 2003 15:13:55 -0800

> spec that describes how or contain text that does.

Aren't we trying to address this issue ? We _have not_ left it at "use
IPSec" level. Glad that we are emphatically on the same page.
If I understand you right, are you proposing that FMIPv6 should design
its own security for FBU ?

-Rajeev

---

From: "James Kempf" <[email-masked]>
Date: Thu, 13 Mar 2003 15:42:57 -0800

> its own security for FBU ?

I'm proposing that you or whoever wants to FBU come up with a design. The design
has to match the threats, and it can't have any open issues, like "how does the
security association get established with the router?" or "how does the security
association get handed over from one router to the next?". So far, I've seen
some suggestions, but nobody has contributed much of a design (except my
proposal for changing the signaling, which nobody seems to like).

I outlined a couple of threats in my email responding to Raj yesterday, there
was some comment from Mohan about them. Other people should contribute threats,
the design should match them.

If you think it's valuable, we can gather the threats into a draft, or somebody
can put them into an issues list on a Web page somewhere (probably a good idea
in any case, even for other issues).

Fair enough?

            jak

---

From: Rajeev Koodli <[email-masked]>
Date: Fri, 14 Mar 2003 16:11:34 -0800

Jim,

I have a comment regarding SA establishment with the
new AR. I think we ought to treat sending FBU like the way we treat, e.g.,
Mobile IPv6 BU to HA. In fact, if the SA has to be in place for
_any_ message that goes out on NAR, then the samething applies
to MIP, FMIP, HMIP,..
On the other hand, the MN needs to have a valid SA with PAR.
I would think that establishing that SA itself should be out of
handover critical path.

Regards,

-Rajeev

---

From: "James Kempf" <[email-masked]>
Date: Sat, 15 Mar 2003 11:20:52 -0800

> I would think that establishing that SA itself should be out of

Sorry, I don't understand.

Why would an SA be needed for any message? The router isn't the end point of a
message.

        jak