Subject: Re: [Mip6] multiple-coa rr tests (was: A Question on Mobile IPv6 -- Alternate Care-of Address option)

From: Ryuji Wakikawa <[email-masked]>
Date: Wed, 03 Dec 2003 15:35:03 +0900

Hi Jari and Tobias and Jee

sorry for my late response.

> Ryuji Wakikawa wrote:
> 
> > I wrote some scenarios in draft-wakikawa-mobileip-multiplecoa-02.txt(section5.4).
> > With this proposal, MN can register multiple CoAs for single Hoa.
> > 
> > When MN sends a BU with an alternate CoA and already registers the
> > source address of the BU as a binding, it does not need to perform
> > CoTI/CoT for the alternate CoA. CN can trust the BU source address
> > because CN has care-of keygen token for the CoA (source address).
> 
> I'm confused. Your draft says:

I was confused in the last email. sorry about that.
As you said, my draft says that MR performs CoTI/CoT for all CoAs.
I understood the problem of DOS which Tobias pointed out.

But once a mobile node registers its one of coa to either HA and CN, can
they believe the mobile node? (I mean the mobile node do not become malicious
one) Even the mobile node registers wrong CoA intentionally, it can be
traced by CN and HA easily. 
Maybe this assumption should not be made, but I am curious of this
assumption

Anyway, one of the reason I added section5.4 in my draft is for
de-registration.
When MN registers two CoAs as multiple bindings and suddenly one of CoA
becomes invalid, MN should deregister the invalid CoA from the active
interface. Otherwise, MN can not get packets at the active interface
till the binding for the invalid CoA is expired or deleted. I should
explain about care-of keygen token availability when MN uses alternate
CoA option in the next version. Maybe not, because MIP6 spec has already
required this condition.

thanks,
ryuji

>     The mobile node MUST sends CoTI for each care-of
>     addresses and MUST receive CoT for each care-of addresses.  The
>     mobile node also generates BID for each care-of addresses to register
>     them as individual bindings .  The registration step is same as
>     the home registration except for calculating authenticator with
>     Binding Unique Identifier sub-option as well as the other sub-options
>     specified in [6].
> 
> and later:
> 
>     If the
>     mobile node registers bindings to a correspondent node, it MUST
>     sends multiple CoTI for multiple care-of addresses.  After getting
>     CoTs, it sends Binding Updates with M flag and a Binding Unique
>     Identifier sub-option for all care-of addresses one by one.
> 
> I agree with what you draft says, but I'm not sure I agree what you
> wrote in the e-mail. The registration of another care-of address
> does not relieve you from the need to test a new care-of address.
> However, of course you need to perform the home address test just
> once and you can reuse the result for multiple care-of address
> registrations.
> 
> --Jari
> 
> 
> _______________________________________________
> Mip6 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mip6

regards,
ryuji

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Jari Arkko <[email-masked]>
Date: Wed, 03 Dec 2003 10:06:19 +0200

> I understood the problem of DOS which Tobias pointed out.

Ok.

> Maybe this assumption should not be made, but I am curious of this

We discussed this during MIPv6 RR design. The conclusion
at that time was that you can trace people through the home
agent relationship, but not through correspondent nodes.
The difference is primarily operational, there is a limited
number of home agents and they are likely administered
well, whereas it may be a lot harder to find the administrator
of random PC acting as a correspondent node.

> CoA option in the next version. Maybe not, because MIP6 spec has already

Yes.

--Jari