Subject: RE: [Mipshop] MIPSHOP discussion on new items and milestones

From: "Soliman, Hesham" <[email-masked]>
Date: Wed, 16 Mar 2005 18:47:03 -0500

> Hesham, you've lost me here. The RG has been having an 
 > active discussion
 > about security for FMIP for over a year. We are about to 
 > refer one draft to
 > MIPSHOP, and there's another coming along that looks 
 > promising. It seems
 > like we are finally starting to get a handle on interesting 
 > technology that
 > actually might be deployable for FMIP security.
 > 
 > On the other hand, nobody at any meeting I've been at has 
 > said anything
 > about practical, deployable security for HMIP, and there are 
 > no drafts on
 > the topic. 

=> Perhaps because you're already assuming that the current solution is not
deployable? Or perhaps because you haven't seen your colleagues draft (I wish
I can remember his name)? Or perhaps the FMIP security issue is more challenging?
I don't know why you haven't seen it, but it's kind of orthogonal to the point I'm making.

  All I am trying to say is I'd like to see the same kind of
 > discussion on practical, deployable security for HMIP that 
 > we've been having
 > for FMIP before we consider referring HMIP to MIPSHOP. Even 
 > if the solution
 > is almost the same (and it might actually be quite 
 > different, or, at least,
 > different enough to be technically interesting). Besides the 
 > technical
 > aspect, it seems only fair.

=> So let's have it in the context of mipshop. I n fact we're having it now :)

 > > No I would not care to do that because I think it's a 
 > waste of time. If
 > this WG
 > > wants to work on it I'll produce a draft, I never thought it was a
 > research issue to
 > > begin with. I don't want to use this list for spam but I 
 > can mention that
 > I already
 > > proposed alternatives in a book I published. Sorry, but I 
 > won't spend time
 > on this
 > > in the IRTF. I'd rather just do it in IETF or in real life when
 > opportunity comes.
 > > IRTF was never a requirement for work in IETF anyway.
 > 
 > My understanding is that MOBOPTS is now a gateway for work 
 > to come into
 > IETF. I believe this is part of the reorganization of IRTF 
 > that the new IRTF
 > Director, Aaron Falk, is trying to achieve, to make IRTF 
 > more relevant to
 > IETF.

=> That's too bad. I'd rather solve it somewhere else.

 > 
 > Besides which, I fail to see why HMIP should be accorded any 
 > different
 > treatment than FMIP. 

=> Good point, what kind of special treatment am I asking for ? I'm asking 
for combinnig the two as an option. So you could argue that I'm asking for a special
treatment for both since I don't discuss this in Mobopts. Frankly, I find it rediculous to
consider this a research project. There are papers and drafts going back to 2000 in some 
cases from several people....

   If its just a matter of taking the 
 > solutions you've
 > outlined in the your book and putting them into a draft, 
 > then what's the
 > problem?

=> I would never assume that. I don't want to waste time in Mobopts because 
the outcome is not addressing the immediate needs of the community. So if 
IETF is not an option, then I'll try elsewhere. I just don't see why IETF is suddenly
not an option.

 > > => The MN cert is issued by CA2 (home operator), which is trusted
 > > by CA5 (local operator) because the home and local 
 > operator agreed on this
 > > as part of their roaming agreement.
 > 
 > So how does this NOT involve certificate provisioning on a 
 > per host basis?

=> Every host has a certificate signed by the same operator. The trust is between
operators, hence aggregated. It's not that there is something specific for each
host. Yes you need certificates on the host, but it's not for an any-to-any kind of trust.

 > So write up a draft for the next RG meeting on it. It even 
 > sounds like you
 > might have some experimental data, which would make the 
 > draft even more
 > compelling.

=> I'm not sure how to make it clearer :) I won't spend time with the RG
on something that simply needs an objective look from engineers. 

Hesham

 >             jak

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "James Kempf" <[email-masked]>
Date: Thu, 17 Mar 2005 08:45:44 -0800

Hesham,

So I'm not interested in wasting any more time on this debate, and I'm sure
nobody on the mailing list is interested in hearing it either. We will have
to agree to disagree.

Gab,

On record, I am opposed to bringing HMIP into MIPSHOP until there is more
discussion in MOBOPTS about practical, deployable security measures.

            jak

----- Original Message ----- 
From: "Soliman, Hesham" <[email-masked]>
To: "James Kempf" <[email-masked]>; "gabriel montenegro"
<[email-masked]>; <[email-masked]>
Sent: Wednesday, March 16, 2005 3:47 PM
Subject: RE: [Mipshop] MIPSHOP discussion on new items and milestones

=> Perhaps because you're already assuming that the current solution is not
deployable? Or perhaps because you haven't seen your colleagues draft (I
wish
I can remember his name)? Or perhaps the FMIP security issue is more
challenging?
I don't know why you haven't seen it, but it's kind of orthogonal to the
point I'm making.

 > aspect, it seems only fair.

=> So let's have it in the context of mipshop. I n fact we're having it now
:)

=> Good point, what kind of special treatment am I asking for ? I'm asking
for combinnig the two as an option. So you could argue that I'm asking for a
special
treatment for both since I don't discuss this in Mobopts. Frankly, I find it
rediculous to
consider this a research project. There are papers and drafts going back to
2000 in some
cases from several people....

=> I would never assume that. I don't want to waste time in Mobopts because
the outcome is not addressing the immediate needs of the community. So if
IETF is not an option, then I'll try elsewhere. I just don't see why IETF is
suddenly
not an option.

 > So how does this NOT involve certificate provisioning on a

=> Every host has a certificate signed by the same operator. The trust is
between
operators, hence aggregated. It's not that there is something specific for
each
host. Yes you need certificates on the host, but it's not for an any-to-any
kind of trust.

Hesham

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is
strictly
 prohibited.  If you are not the intended recipient please contact the
sender
 and delete all copies.
===========================================================

---

From: "Jean-Michel COMBES" <[email-masked]>
Date: Fri, 18 Mar 2005 14:58:18 +0100

Hi,

I don't understand why must HMIP works be moved to IRTF. I know some
protocols that have been designed in the IETF without implementation. And
today, I see HMIP, which has been implemented (I know at least two
implementations) and tested, rejected to IRTF ... Strange or I missed
something.

Regards.

JMC. 

France Telecom - R&D Division - MAPS/NSS   
Jean-Michel COMBES, Internet/Intranet Security
E-Mail: [email-masked]
Phone: +33 (0)1 45 29 45 94
Fax: +33 (0)1 45 29 65 19
Mobile: +33 (0)6 07 29 30 16 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Soliman, Hesham
> Sent: Thursday, March 17, 2005 12:47 AM
> To: James Kempf; gabriel montenegro; [email-masked]