Subject: RE: [Mipshop] HMIPv6 improvements in new list of MIPSHOP items fornewcharter

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 13 May 2005 17:17:00 -0400

> > => First, let me repeat the question I asked earlier during this
 > > discussion (I never saw an answer for it): What do we want 
 > to address
 > > in this draft? Is this to address a "different" way of securing
 > > MN-MAP communication?
 > > 
 > > My particular concern is deployability of security.
 > > 
 > > W.r.t. authenticating and authorizing for HMIP service, in the
 > > Bootstrapping
 > > DT, we discussed security for dynamic assignment of local 
 > home agent,
 > and
 > > there are some very difficult issues that could potentially tightly
 > > constrain how a dynamically assigned local home agent could be
 > deployed. A
 > > HMIP MAP is very similar to dynamic local home agent. 
 > Assuming certs
 > can
 > > be
 > > deployed on all hosts, as the current draft does, is not realistic,
 > though
 > > it may be an option in some fairly limited circumstances.
 > 
 > Using RADIUS/Diameter between the MAP and a AAA server is another
 > option. The possibly long overhaul between the end-points is 
 > a concern
 > for performance, but otherwise this should work.

=> Agreed. Two remarks though: 1) this delay would only happen
at startup time or when renewing the SA. So it's not that 
significant. 2) Depending on the system in question, you could
use AAAL instead of AAAH to setup the association. This would 
remove that delay.

 > 
 > > Also, I think it might be useful to say something about DoS attack.
 > Any
 > > time
 > > a network node address is handed out to a host, the 
 > potential for DoS
 > > attack
 > > is there. To a certain extent, a MIP HA faces the same 
 > problem but it
 > is
 > > more limited. Since HMIP is proposing that MAPs become 
 > widely deployed
 > as
 > > part of access networks, there is a potential for widespread
 > disruption of
 > > service at the access network level if a DDoS attack is 
 > launched on an
 > > operator's access network.
 > 
 > I cannot understand why we'd be concerned about publishing the IP
 > address of a MAP to a bunch of locally attached hosts (which are
 > authenticated, and traceable), while we are perfectly fine with
 > publishing IP address of a HA to the whole Internet (no 
 > authentication,
 > no traceability, size and threats incomparable to a 
 > well-managed access
 > network)... I don't think one can practically boost the 
 > security around
 > the HA to compensate for the difference in threat levels.

=> I agree of course. I don't think this is an issue.

Hesham

 > Alper

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: Alper Yegin <[email-masked]>
Date: Fri, 13 May 2005 14:29:16 -0700

> at startup time or when renewing the SA. 

I agree.

> So it's not that
> significant. 

I guess it depends on where the AAAH is.

> 2) Depending on the system in question, you could

You need the AAAL to be able to authorize the MN.

Alper

> This email may contain confidential and privileged material for the
sole
> use