Subject: RE: [Mipshop] HMIPv6 improvements in new list of MIPSHOP items fornewcharter

From: Gerardo Giaretta <[email-masked]>
Date: Fri, 13 May 2005 12:09:20 +0200

Hi Hesham,

please see below..

>  > => First, let me repeat the question I asked earlier during this
>  > discussion (I never saw an answer for it): What do we want 
> to address
>  > in this draft? Is this to address a "different" way of securing
>  > MN-MAP communication?
>  > 
>  > My particular concern is deployability of security.
>  > 
>  > W.r.t. authenticating and authorizing for HMIP service, in 
>  > the Bootstrapping
>  > DT, we discussed security for dynamic assignment of local 
>  > home agent, and
>  > there are some very difficult issues that could potentially tightly
>  > constrain how a dynamically assigned local home agent could 
>  > be deployed. A
>  > HMIP MAP is very similar to dynamic local home agent. 
>  > Assuming certs can be
>  > deployed on all hosts, as the current draft does, is not 
>  > realistic, though
>  > it may be an option in some fairly limited circumstances.
> 
> => I'll note that down on the concerns list. If someone 
> agrees or disagrees please voice your opinion to help
> set the goal for this work.
> 

I agree with James here. 

I'm a member of the MIP6 bootstrapping DT and I think that the
assignment of a MAP in the visited domain as well as the assignment of a
local HA raise some issues. Certs on all hosts is not realistic and a
PKI is not easily deployable. I would be interested in a solution for
authentication and authorization of HMIPv6 that is flexible enough to be
used with other types of credentials. Something similar to what is EAP
in IKEv2 for VPNs. If this is the goal, I can work on that, too. 

--Gerardo   

>  > 
>  > Also, I think it might be useful to say something about DoS 
>  > attack. Any time
>  > a network node address is handed out to a host, the 
>  > potential for DoS attack
>  > is there. To a certain extent, a MIP HA faces the same 
>  > problem but it is
>  > more limited. Since HMIP is proposing that MAPs become 
>  > widely deployed as
>  > part of access networks, there is a potential for widespread 
>  > disruption of
>  > service at the access network level if a DDoS attack is 
>  > launched on an
>  > operator's access network.
> 
> => But do you have the same concern for other nodes like DNS, DHCPv6
> (it allows direct communication), other local servers ...etc?
> I guess I don't understand why this is specific to MAPs.
> 
> Hesham
> 
>  > 
>  >             jak
>  > 
>  > 
>  > 
> 
> ===========================================================
> This email may contain confidential and privileged material 
> for the sole use
>  of the intended recipient.  Any review or distribution by 
> others is strictly
>  prohibited.  If you are not the intended recipient please 
> contact the sender
>  and delete all copies.
> ===========================================================
> 
> 
> _______________________________________________
> Mipshop mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mipshop
> 

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to
[email-masked]. Thank you
====================================================================

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 13 May 2005 12:42:44 -0400

> => This is not true. The MAP is located in the core, unless you
 > have a very wide definition of access. Do you consider a PDSN/GGSN
 > an access node? if so do you consider the next router up an access
 > node? If you answer yes to the above then I see why conclude 
 > the following.
 > However, normally people refer to access networks as those 
 > in the RAN.
 > This is where most of the cost is, not in routers, it's the 
 > radio equipment
 > and their connectivity to the Internet that costs the most.
 > 
 > jak>> Our FOMA network in Japan has exactly one GGSN for the 
 > entire country.
 > Some of the designs I've seen kicked around using HMIP put a 
 > MAP on every
 > subnet in the access network. So I don't believe the 
 > comparsion is accurate.
 > The GGSN is more like a Mobile IP home agent.

=> I'm confused. If you have one GGSN (i.e. AR) you 
basically have on subnet. Nothing below the GGSN is visible 
to the IP layer in the host, so I don't know why you'd
use a MAP at all.

Hesham

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

---

From: "Soliman, Hesham" <[email-masked]>
Date: Fri, 13 May 2005 17:35:01 -0400

> > 2) Depending on the system in question, you could
 > > use AAAL instead of AAAH to setup the association. This would
 > > remove that delay.
 > 
 > You need the AAAL to be able to authorize the MN.

=> Sure, that's possible. That's why I said depending on the system.

Hesham

 > Alper
 > attack.
 > >  > Any
 > >  > > time
 > >  > potential for DoS
 > >  > > attack
 > >  > problem but it
 > >  > is
 > >  > widely deployed
 > >  > as
 > >  > I cannot understand why we'd be concerned about 
 > publishing the IP
 > >  > address of a MAP to a bunch of locally attached hosts (which are
 > >  > authenticated, and traceable), while we are perfectly fine with
 > >  > publishing IP address of a HA to the whole Internet (no
 > >  > authentication,
 > >  > no traceability, size and threats incomparable to a
 > >  > well-managed access
 > >  > network)... I don't think one can practically boost the
 > >  > security around
 > >  > the HA to compensate for the difference in threat levels.
 > > 
 > > => I agree of course. I don't think this is an issue.
 > > 
 > > Hesham
 > > 
 > >  >
 > >  > Alper
 > >  >
 > >  >
 > >  >
 > >  >
 > > 
 > > This email may contain confidential and privileged material for the
 > sole
 > > use
 > others is
 > > strictly
 > contact the
 > > sender