Subject: RE: security between MN and the MAP (was Re: [Mipshop] RE: IESG evaluation - Steve Bellovin's comments)

From: "Soliman, Hesham" <[email-masked]>
Date: Wed, 17 Nov 2004 15:11:44 -0500

> the current HMIPv6 document seems to the say the security
 > between MN and the MAP (to protect the binding updates) is
 > the same the security between MN and the HA. that is wrong.
 > in MIPv6, the HA needs per-mobile state to authenticate and
 > authorize the MN. since there is one HA per MN, this is
 > do-able. for HMIPv6, this is not true. the MN could attach
 > to many different MAPs. this would require a way for each
 > MAP to authenticate (and authorize) any MN that attaches to
 > the visited network. each MN should also be able to
 > authenticate any MAP that it might attach to. this is
 > do-able too, but the document needs to point out this
 > significant difference and not just equate it to MIPv6
 > security.

=> Hmm, are you saying that a MN cannot attach to several
HAs? That would contradict the MIPv6 spec. A MN can certainly
send BUs to many HAs. 

 > 
 > similarly, it is not correct to equate security between MN
 > and the MAP to security between MN and the AR. in most cases,
 > the MN needs to authenticate itself to the access network.
 > and in most cases, some state is created on the access
 > routers. a MAP is an element that sits beyond the access
 > routers. SEND could be used between the MN and the AR. but
 > I dont see how SEND can be used beween the MN and the MAP.

=> No one needs SEND to work with a MAP. You are confusing 
the MAP location, a MAP can be an AR...
You also seem to confuse the existence of an SA with the quality of the 
SA. Just because a MN has an SA with an AR does not make this 
SA suitable for mobility signalling. 

 > 
 > it would be better not to equate security between MN and the
 > MAP to either security between MN and the AR or security
 > between MN and the HA. 

=> What does equate mean??? Who's equating a MAP (located in the 
core) with an AR??? I don't know which thread you're referring to
because I didn't see that assertion made by anyone...

 > 
 > between the MN and the HA, one could use shared secrets with
 > IKE in addition to certificates. but between the MN and the
 > MAP, I dont see shared secretes being used. 

=> This is already stated on the list and in the draft.

    you probably
 > need certificates, which means, that unless the MAP is able
 > to verify the certificate presented by the MN, the MN wont
 > get HMIPv6 service. similarly, unless the MN can verify the
 > certificate presented by the MAP, it cant use HMIPv6.

=> Again, this is already agreed on this list and will be 
added to the draft. I'm not sure if you're asking for 
additional words here?

Hesham

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: Vijay Devarapalli <[email-masked]>
Date: Wed, 17 Nov 2004 13:46:28 -0800

> HAs? That would contradict the MIPv6 spec. A MN can certainly

not as many MAPs that a MN might encounter. in addition, HA
and MN belong to the same administrative domain.

> added to the draft. 

good. it wasnt clear that this was the conclusion.

 > I'm not sure if you're asking for
> additional words here?

I will wait for the revised security considerations section.

Vijay