Subject: RE: [Seamoby] CAR Discovery Requirements ... Call for Comments

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Thu, 14 Mar 2002 09:38:03 -0600

Govind, 

Sorry for the delay, I just came back from vacation :)
See my comments below, 

<snip>

>Madjid>OK. However, remember that the original attraction of
>CAR as a protocol will be greatly diminished (IMHO) if it can't
>handle inter-domain.
>

----> Thats why we  have to decide whether it is a SHOULD or a MUST.

Madjid>> Well, to make it brief, I would say, if you want me
as a costumer for your "CAR", make interdomain a MUST, otherwise, I will
buy domestic and not from Seamoby:) 

[snip]
>
>Madjid>> Well, not quite, there are two issues, first
>The AR-AR SA is a big IF, in case of inter-domain (I am guessing
>you are dealing with more than just one new AR, right). Now, since
>inter-domain is a should, I give up on this, lets move to the second
>issue, you seem to be assuming that from oldAR-MN and oldAR-NewAR
>SA you can deduce newAR-MN SA? How, you said that CAR comes before
>Context transfer.

------> Agreed that old AR - new AR SA maybe a toughie, maybe SIKED can help

us with this :)

But once that is established we can have two tunnels is it not? One tunnel 
to the old AR from the MN and then another tunnel to the new AR. Ofcourse, 
this is a trivial solution and may not be the optimal way to go, but wont 
this work?

Madjid>> Intra domain this works (I assume, by "tunnel", you are talking
about a secure tunnel, otherwise I fail to see the need for a tunnel.

Regards,

Madjid

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Thu, 14 Mar 2002 09:50:20 -0600

Hi Dirk, sorry for the delay,

See comments below, 

> Madjid>> I responded to Govind on this issue. However, to respond
> to the above, my issue is, say the MN needs some information before
> the handover, that the AR thinks it is too sensitive to be 
> shared, then
> the whole thing would fall apart in an inter-domain scenario??

In an MN-based decision approach, the selection of a TAR is still possible
in general since it is always under the constraint of the revealed
information. It is certainly true that this constraint is more stringent
in the N case. But that's a drawback which lies in the fact to put the 
decision in the MN. You could do this also in the AR. 

Madjid>> Are you envisioning different selection algorithms depending on 
whether it is done at AR or MN?
I am hearing that you are willing to sacrifice the quality
of TAR selection for the sake of not having good security, in case
the selection is done by MN (which also means a less elaborate selection
algorithm).
In either case, if sensitive information regarding the network
is shared with MN, it needs to be in a secure fashion and after
making sure that the MN is a trusted recipient for this information.

I don't want to go too much into using context transfer for
AR capability transfer since it is certainly not the scope of
CT to do this. 

Madjid>> I have been involved in CT development in seamoby from 
very begining and I don't recall making capability transfer
out of scope. You could argue that CAR comes before CT (like
Govind did) and that is acceptable, but CT does not segregate
on the type of data it transfers.

Right now, the requirements cover the capability exchange which is
meant to happen between ARs. As for a capability transfer from the
AR to an MN for performing a TAR selection in the MN, we could 
incorporate this by extending requirement 3.4 in the way that
each transfer of capability information within CAR has to happen
in a secure manner. We should probably then also rename the heading
of 3.4 in 'capability transfer'. You should also keep in mind that
that the MN gets the information from the old AR, so it is enough
to an SA between MN and old AR. The old AR (hopefully) has information
regarding the potential new ARs (AKA CARs) which are then transferred
to the MN. I have to admit that I didn't get your comment in a mail
to Govind that you need an MN-newAR SA? For what is this in the 
context of CAR. CAR discovery is meant to determine the new AR, so
why should I have an SA to this entity in the process of CAR??

Madjid>> I don't see why the capability info HAS to go to MN 
through oldAR (especially, if old AR originally does not have this info)
, other than security reasons. If the TAR selection
algorithm does not need sensitive info, or MN is trusted by the 
new network, it would make perfect sense to send the data directly 
to the MN (in case MN is making the selection).

Regarding the inter-domain SHOULD issue, I agree that CAR without
inter-domain reduces the relevance of CAR a lot. That's why I think
that MUST is better.

Madjid>> I have yet to see where intra-domain CAR is needed, so I am
for MUST.

Regards,
Madjid

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Thu, 14 Mar 2002 09:50:20 -0600

See comments below, 

Regards,
Madjid

---

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Thu, 14 Mar 2002 09:38:03 -0600

Govind, 

<snip>

[snip]

us with this :)

Regards,

Madjid