Subject: FW: [MIPSHOP-MIH-DT] Current version -- Fri 07

From: Sam Xia <[email-masked]>
Date: Sat, 08 Sep 2007 17:41:54 +0800

> - I just realised that we did not address transport security. We 
> should have some text recommending the usage of TSL/DTLS depending on 
> the transport.

SAM: I agree that we should address the transport security.  Even subir said
a new work group would be setup to discuss the transport security issues at
the MIH level, I think that we should address this problem, for example, to
compare different secuirty solution and list their prons and cons,
especially to address how to distribute key materials.

not sure TLS/DTLS is better than IPsec.

> network the dhcp server is: local or home. There is also no 
> explanation on why auth happens and why the whole discovery is coupled
with NAA.
    As mentioned earlier, DHCP server is not in the home. It is in the
visited network. We can explain
    the steps. However, we need to define some additional DHCP options to
support this case.

<gabor> what dhcp options do we need and why? I thought you said earlier
that you want the MoS address be sent using AAA signalling.
Could you clarify this scenario with all its dirty details? I am not
familiar with this AAA--NAS--DHCP staff. Is there some similar solution
available yet or are we inventing a brand new thing here?

SAM> please refer drafts Tele metioned before. here are their links:
http://www.ietf.org/internet-drafts/draft-ietf-mip6-bootstrapping-integrated
-dhc-05.txt
http://www.ietf.org/internet-drafts/draft-ietf-mip6-hiopt-06.txt
http://www.ietf.org/internet-drafts/draft-ietf-mip6-radius-02.txt

SAM> all the discovery mechnisms are similar for all 4 scenario.  I suggest
that we should reserve only two diagrams, one for DHCP discovery, the other
for DNC dicovery, and we can explain how to discovery in 4 kinds scenarios.
Then Seciton 5 looks good, not redundant and unuseful.

> - security considerations: it only addresses the security regarding 
> discovery. Let's re-formulate this part: "In case where DNS is used 
> for discovering the IP address of the MIHF and mobility services and 
> data origin authentication and data ..." to "In case where DNS is used

> for discovering MoS, fake DNS responses may cause DoS and the 
> inability of the MN to perform a proper handover. Where networks are 
> exposed to such DoS, it is RECOMMENDED that DNS service providers use 
> the Domain Name System Security Extensions (DNSSEC) as decsribed in 
> [RFC4033].  Readers may also refer to 
> [I-D.ietf-dnsop-dnssec-operational-practices] to consider the aspects 
> of DNSSEC Operational Practices. " The previous two paragraphs are ok.
>   
   Fine.
> - the transport layer security recommandations could be added either 
> to the security section or to the transport section (section 6).

SAM> I agree.

_______________________________________________
MIPSHOP-MIH-DT mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop-mih-dt

---

From: <[email-masked]>
Date: Sat, 8 Sep 2007 17:39:33 -0500

SAM> please refer drafts Tele metioned before. here are their links:
http://www.ietf.org/internet-drafts/draft-ietf-mip6-bootstrapping-integr
ated
-dhc-05.txt
http://www.ietf.org/internet-drafts/draft-ietf-mip6-hiopt-06.txt
http://www.ietf.org/internet-drafts/draft-ietf-mip6-radius-02.txt

Ok, I think I understand what scenario in 5.3 is supposed to cover. But
we need a whole lot more text in this section than we currently have.
Also, we would need corresponding Diameter, Radius and DHCP relay agent
options. I'd propose that we leave out this scenario from the initial
draft and take the time to work it out.

Also, I am not sure we need the "NAS/DHCP Relay" box in figure 7a. Do
we?

- gabor

---

From: Subir Das <[email-masked]>
Date: Sun, 09 Sep 2007 12:03:22 -0400

Gabor,
Yes,  this is defined for MIPv6 case and following is the correct draft. 
They used it for HA discovery.
The new DHCP option is Relay_Agent_option. The NAS/relay agent will 
obtain the
MoS server address and relay agent will forward that to the DHCP server. 
If we do not have a
relay agent, we need to define a protocol between NAS and DHCP Server. 
You are
correct that we need to do some work in Dime and in Radius ext WG. My 
understanding was
Tele pointed out this scenario  and kept as a place holder to develop it 
further.

Thanks,
-Subir

---

From: Telemaco Melia <[email-masked]>
Date: Mon, 10 Sep 2007 14:26:07 +0200

Subir Das wrote:
> Gabor,
> Yes,  this is defined for MIPv6 case and following is the correct 
> draft. They used it for HA discovery.
> MoS server address and relay agent will forward that to the DHCP 
> server. If we do not have a
> Tele pointed out this scenario  and kept as a place holder to develop 
> it further.
>
> Thanks,
> -Subir
Yes, this was my intention.
I think that the result of the DT would be poorly evaluated if we do not 
consider what the WG produced for HA discovery.
I also think that the AC on Wednesday is necessary to fix the changes. I 
agree with Gabor that we can work out details
later on and publish the draft, however the basic mechanisms have to be 
agreed.

tele