Subject: Re: On the NECESSITY of MIP for LMM (was Re: [Mipshop] WG Last Call comments ...)

From: "Carl Williams" <[email-masked]>
Date: Tue, 4 Nov 2003 21:30:59 -0800

James, 
 
    Please see my in-line comments.

--- James Kempf <[email-masked]> wrote:
> From: "James Kempf" <[email-masked]>
> To: <[email-masked]>, <[email-masked]>
> Subject: Re: On the NECESSITY of MIP for LMM (was
> Re: [Mipshop] WG Last Call comments ...)
> Date: Tue, 4 Nov 2003 15:34:20 -0800
> 
> Carl,
> 
> At the time these requirements were proposed, the
> Mobile IP WG had the
> intent of making the FMIPv6 and HMIPv6 standards,
> and they certainly served
> as a basis for agreement on what properties the
> protocols should have for
> that specific goal, though the security requirements
> are still quite
> deficient, IMHO. 
 
Yes, and this is what I have been saying.  The LMM
analysis was started by you back in March-April 2001
as a result of some concerns you had with proposed
LMM (MIP-based) solutions.  I recall Phil and Basavaraj doing a
good job of managing those heated debates/discussions.
The working group later became focused on MIPv6 security
and LMM wasn't able to advance until this document was finalized.
During this time period you even wrote BETH as a proposed
LMM solution.
 
Positives things happened from this discussion
and we (as a working group) progressed in our thinking
on this subject.  See details in my previous emails.
 
Some of the security requirement text was produced by
you so I welcome any additional text.  I will be adding
a section on security consideration so we can address
this here as well.  I do like your idea of an independent security
threat analysis document - some security analysis was done during
requirement discussion but that wasn't the focus.
I think we can stay the course with the proposed MIPSHOP 
milestones and maybe the working group can do a threat 
analysis in parallel.
 
> But given that circumstances have
> changed, and these
> protocols are not intended to become standards, I
> think it is prudent to
> question what exactly the goals of these
> requirements are, going forward.
> 
 
The present plan in MIPSHOP is to advance HMIPv6
documents to experimental status.  It was always 
the intent to evaluate these protocols according to
the requirements.   This evaluation is still valid even
if these proposed protocols are only advancing
to experimental status.  Long-term it could very well
be that the decision is to advance the solutions
to standard.  Regardless, the requirements are serving 
a purpose.

> I personally don't believe that it is prudent to
> bind the IRTF MOPOPTS RG by
> requirements that were developed 2 years ago for
> protocols that were
> intended to be standards track. Research is
> different than standardization
> activity, and I believe that one must leave open the
> possibility of an "out
> of the box" solution that might evolve the Mobile IP
> architecture in a
> particular direction not covered by the Mobile IP
> architecture at the time
> these requirements were generated, with regard to
> security in particular.
 
 This is my view as well.   My email was only responding
to a comment you made:
 
      "If the LMM requirements are not intended to
       guide the IRTF work or the work in the IETF,
       then what is the point of doing them?  IF they
       are, and, and Gab has said, the IRTF work is
       intended to take a wide view than just MIP, then
       what is the purpose of making the requirements
       MIP specific?"
 
I initially thought that you were advocating to guide
the IRTF with the requirements.
 
What I am advocating is that much has been discussed
in IETF (both MIP and Seamoby, etc...) and it serves as
useful IRTF input  - indeed, IRTF IP mobility group was
formed as a result of our IETF discussions.  Imposing
IETF requirements will only serve to restrict the IRTF
and I am certainly not advocating that.
However, what we (IETF MIP) have learned is very useful input
to the IRTF; indeed, I have given two presentations
on LMM problem statement to the IRTF.  So this
is the kind of input or guidance that I was referring to.

> In
> fact, at the time these requirements were generated
> the Mobile IP
> architecture did not include Return Routability, so
> the Mobile IP
> architecture has already evolved from where it was
> when the requirements
> were originally generated.
 
This is why we didn't advance LMM - we were
waiting for MIPv6 security to be sorted out first.
 
> As I've mentioned, the
> Seamoby WG has discarded
> all requirements for exactly this reason, because
> the protocols are being
> proposed for publication as experimental, and the
> Research Group will need
> the flexibility to move the architecture forward.
> 
 
No.  Most of the seamoby work was moved into
the IRTF.  That is not the case here.  MIP LMM
has not moved to the IRTF.  It is in the IETF MIPSHOP
working group.
 
I also wish to say that requirement documents
in general got a bad rap as a result of seamoby.
That is unfortunate.  If you, Phil and Basavaraj
didn't initiate the LMM requirement analysis in MIP,
I don't think we would have progressed to the point we
have in terms of IP mobility.  There were many
positive things to come out of that discussion/debate.
The requirements document is only one result
of that discussion.  
 
I know you personally and know you to rethink
your positions. Hopefully, you can do that
on requirement documents in general.
 
> Pekka has proposed removing specific mention of
> Mobile IP, and that would be
> an acceptable compromise IMHO, as long as the result
> is not phrased in such
> a way that it would require radical changes in the
> Internet architecture to
> accommodate (such as completely changing Internet
> routing or adding new
> layers in the stack). In addition, I believe the
> security requirements need
> strengthening. In fact, a comprehensive threat
> analysis would be my
> preference, but that may be too time consuming to be
> accommodated by the
> desire of the WG to complete this work quickly.
> 
 
As I have said, we can remove the MIP specific language
from the requirements document.  Pekka has already done
this and sent me the updated doc.   The working group will
need to review/approve this change.   
 
Again, I do like your idea of a threat analysis document.
Hopefully, this is something MIPshop may be able to
accommodate somehow.
 
Carl

>             jak

---

From: "James Kempf" <[email-masked]>
Date: Wed, 5 Nov 2003 09:43:49 -0800

Carl,

Regardless of the history of this draft, we must deal with the situation as
it exists now. The issue for me is: what is the value of this draft going
forward? As mentioned, I see little value for the IRTF MOPOPTS RG which is
where the MIPSHOP work will ultimately go, and personally believe it should
be flushed as were the Seamoby requirements drafts. But making it
independent of the current Mobile IP architecture, as Pekka has suggested,
is an adequate compromise to ally my concerns that it will be overly
constraining on the efforts of the MOPOPTS RG to evolve the Mobile IP
architecture.

Specific comments

> has not moved to the IRTF.  It is in the IETF MIPSHOP

That's ancient history, Carl. After the micromobility work was moved to IRTF
(where it died), Seamoby spent 2.5 years arguing about requirements. I would
not charaterize that as "most of the work being moved into the IRTF". I
would charaterize it as "the WG in the IETF attempted to define requirements
adequate for standardization and failed". It was a lot of work but, in the
end, the requirements turned out to be fairly useless for guiding any
standardization activity as judged by the IESG and were rightly flushed. Now
the Seamoby WG is producing two protocol documents,
draft-ietf-seamoby-card-protocol-04.txt and draft-ietf-seamoby-ctp-05.txt,
which are to go to the MOPOPTS RG for integration with the MIPSHOP WG work,
which is also to go to MOPOPTS.

So, the ultimate goal of both MIPSHOP and Seamoby is the same in this
respect: to advance the protocol documents to experimental for further
study. I don't see LMM requirements as being any more useful for the MOBOPTS
work than the Seamoby requirements were, quite frankly.

> The requirements document is only one result

I think that is ascribing too much weight to the requirements document.
Personally, I believe the reason there has been little discussion about IP
mobility in the last few years is because the people who were arguing about
it lost interest or had other things to do. Pekka and I introduced a draft
last spring on aligning the IP mobility local handover architecture more
closely with the standard IP local link configuration and routing
architecture, but dropped it when it became apparent that the WG was
exhausted with the topic and wanted to just finish up with the existing
work, which is one reason why MIPSHOP was formed. So, my view is that the
requirements document is a historical artifact with very little usefulness
to the IETF, and a potential to overly constrain research in the IRTF if it
is not properly done.

> need to review/approve this change.

Great, that's all I'm interested in at this point.

> Hopefully, this is something MIPshop may be able to

I think it would be better to do that in the MOBOPTS RG. Some of the people
involved are security experts with focal point in wireless security. I think
MIPSHOP should finish its documents and disband as quickly as possible, so
MOBOPTS can get on with the job.

            jak

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop