Subject: RE: [Mipshop] HMIPv6 improvements in new list of MIPSHOP itemsfornewcharter

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 13 May 2005 10:01:52 -0400

> > => I'll note that down on the concerns list. If someone 
 > > agrees or disagrees please voice your opinion to help
 > > set the goal for this work.
 > > 
 > 
 > I agree with James here. 
 > 
 > I'm a member of the MIP6 bootstrapping DT and I think that the
 > assignment of a MAP in the visited domain as well as the 
 > assignment of a
 > local HA raise some issues. Certs on all hosts is not realistic and a
 > PKI is not easily deployable. 

=> Please note that no one is suggesting PKI. 
Is there anything I can read about the difficulty of using certs on hosts?
Does anyone know of literature about this?

Hesham

I would be interested in a solution for
 > authentication and authorization of HMIPv6 that is flexible 
 > enough to be
 > used with other types of credentials. Something similar to 
 > what is EAP
 > in IKEv2 for VPNs. If this is the goal, I can work on that, too. 
 > 
 > --Gerardo   
 > 
 > >  > 
 > >  > Also, I think it might be useful to say something about DoS 
 > >  > attack. Any time
 > >  > a network node address is handed out to a host, the 
 > >  > potential for DoS attack
 > >  > is there. To a certain extent, a MIP HA faces the same 
 > >  > problem but it is
 > >  > more limited. Since HMIP is proposing that MAPs become 
 > >  > widely deployed as
 > >  > part of access networks, there is a potential for widespread 
 > >  > disruption of
 > >  > service at the access network level if a DDoS attack is 
 > >  > launched on an
 > >  > operator's access network.
 > > 
 > > => But do you have the same concern for other nodes like 
 > DNS, DHCPv6
 > > (it allows direct communication), other local servers ...etc?
 > > I guess I don't understand why this is specific to MAPs.
 > > 
 > > Hesham
 > > 
 > >  > 
 > >  >             jak
 > >  > 
 > >  > 
 > >  > 
 > > 
 > > ===========================================================
 > > This email may contain confidential and privileged material 
 > > for the sole use
 > >  of the intended recipient.  Any review or distribution by 
 > > others is strictly
 > >  prohibited.  If you are not the intended recipient please 
 > > contact the sender
 > >  and delete all copies.
 > > ===========================================================
 > > 
 > > 
 > > _______________________________________________
 > > Mipshop mailing list
 > > [email-masked]
 > > https://www1.ietf.org/mailman/listinfo/mipshop
 > > 
 > 
 > 
 > Gruppo Telecom Italia - Direzione e coordinamento di Telecom 
 > Italia S.p.A.
 > 
 > ====================================================================
 > CONFIDENTIALITY NOTICE
 > This message and its attachments are addressed solely to the persons
 > above and may contain confidential information. If you have received
 > the message in error, be informed that any use of the content hereof
 > is prohibited. Please return it immediately to the sender and delete
 > the message. Should you have any questions, please send an e_mail to
 > [email-masked]. Thank you
 > ====================================================================
 > 
 > _______________________________________________
 > Mipshop mailing list
 > [email-masked]
 > https://www1.ietf.org/mailman/listinfo/mipshop
 > 

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "James Kempf" <[email-masked]>
Date: Fri, 13 May 2005 09:33:33 -0700

jak>> Again, this is more deployment experience than literature. The most
successfully deployed security protocol in the Internet is TLS, which does
not require host certificates. We designed SEND specifically to avoid
requiring host certificates, based on this. And, IKEv2 included EAP
authentication in response to a collection of nonstandard vendor-specific
modifications in IKEv1 that used un/pw auth which were included in products
to avoid requiring deployment of PKI for configuring hosts with
certificates. Jari gave a presentation at MOBOPTS in Minneapolis, see
http://www3.ietf.org/proceedings/05mar/slides/MobOpts-1/sld1.htm, in which
he talked about the problems of requiring host certificate deployment for
securing handover protocols.

jak>> Actually, I think this might make a good paper, along the lines of
Chapter 26 in Kaufman, Perlman and Speciner.

            jak