Subject: Re: [Mipshop] Gauging interest in official WG adoption of IDs

From: gabriel montenegro <[email-masked]>
Date: Tue, 25 Jul 2006 18:31:19 -0700 (PDT)

Sure, the document can be renamed if it ends up talking about stuff other than what it does currently.
The title should reflect what the content ends up being. Don't need to decide that now.
 
As for AAA for HMIPv6, it seems like someone must have talked about this, but I'm drawing a blank.
Does anybody remember?
 
I do note that
http://tools.ietf.org/wg/mipshop/draft-vidya-mipshop-handover-keys-aaa-03.txt mentions the possibility of
reusing those keys for HMIP as well, but offers no further details. Vidya? 

-gabriel

----- Original Message ----
From: Alper Yegin <[email-masked]>
To: gabriel montenegro <[email-masked]>; "Faccin, Stefano M" <[email-masked]>; [email-masked]
Sent: Tuesday, July 25, 2006 3:26:57 PM
Subject: RE: [Mipshop] Gauging interest in official WG adoption of IDs

Hi Gabriel,

My comments inlined.

In general, I recommend looking at the charter to determine what the WG
already decided.
 
HMIPv6-bis addresses this to some extent, as Hesham is adding clarifying
text on how
to use IPsec, and the draft below talks about another solution. If there are
more solutions,
the draft below is the place to define them. Hopefully, we'll have only one
in the draft below (not necessarily 
the starting point), cuz having multiple mechanisms is less preferable, in
my opinion.
 
Alper>>> OK, I see. But than probably it is better to rename the document.
It is called " Using Cryptographically Generated Addresses (CGA) to secure
HMIPv6 Protocol (HMIPv6sec)" now. A generic name like "HMIPv6 Security" is
better unless we want to tie the document to this specific (CGA-based)
solution. 

It is, after all, a draft that is supposed to address *HMIPv6 security* as
per our
charter, not necessarily a draft to publish this solution exclusively. This
solution is only a starting
point, but the real deliverable in the charter is "MN-MAP security" (and in
the milestones "HMIPv6
security"). 
 
We have a deliverable for HMIPv6 security, so that document should reflect
the WG decision.
 
Of course, even after we publish this, there's always the 
chance to recharter...

Alper>>> I'm specifically interested in a solution that is AAA-based. Much
like what we did in
http://www.watersprings.org/pub/id/draft-yegin-eap-boot-rfc3118-01.txt for
securing DHCP. Was such an approach ever discussed?

Thanks.

Alper

-gabriel
----- Original Message ----
From: Alper Yegin <[email-masked]>
To: "Faccin, Stefano M" <[email-masked]>; [email-masked]
Sent: Tuesday, July 25, 2006 10:26:28 AM
Subject: RE: [Mipshop] Gauging interest in official WG adoption of IDs
 
Stefano,
 
Regarding the HMIPv6 security solution Can you conform whether the WG is
open to consider alternative solutions even after one (below) is accepted as
a WG document? Or, has the WG decided to pick one solution and stop there?
 
Alper

________________________________________
From: Faccin, Stefano M [mailto:[email-masked]] 
Sent: Wednesday, July 19, 2006 9:52 AM
To: [email-masked]
Subject: [Mipshop] Gauging interest in official WG adoption of IDs
 
Hi,
Last week during the mipshop meeting we talked about 2 potential drafts up
for adoption as official WG drafts. 
 
So the question to the WG is: should we adopt the following documents as
official WG items (based on the individual drafts as noted below)?
- draft-haddad-mipshop-hmipv6-security-04
- draft-arkko-mipshop-cga-cba-04.txt
 
Please send comments one way or another through August 8, 2006.
 
Thanks,
 
Stefano M. Faccin
Mobility Group - Technology & Standards
Mobility Wireless Group
Intel Corporation
+1 408 966 2334
[email-masked]

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Wed, 26 Jul 2006 10:35:27 -0700

draft-vidya-handover-keys-aaa-03 describes a protocol that allows single roundtrip AAA-based keying that can generically be used between two entities (e.g., MN and MAP). No changes should be needed in the protocol itself for this. At the time of writing the document, the need for FMIP was more urgently identified and hence, the document describes the protocol as running between the MN and the AR. 
 
Having said that, it is very straightforward to use the protocol to HMIP. 
 
However, there may be less motivation to use anything other than IKEv2/IPsec for HMIP than for FMIP - for FMIP, doing IKEv2 with every AR is too expensive. For HMIP, the MN doesn't change a MAP that frequently. Also, given that new MAPs can be discovered while still attached to the current MAP, I feel it should be okay to say that IKEv2/IPsec is the recommended solution. The credential problem is solved using EAP in IKEv2 as well, thereby fitting the AAA-based credential usage model. 
 
Alper, do you feel the need for something more efficient than IKEv2 for HMIP? 
 
Vidya

________________________________

	From: gabriel montenegro [mailto:[email-masked]] 
	Sent: Tuesday, July 25, 2006 6:31 PM
	To: Alper Yegin; Faccin, Stefano M; [email-masked]
	Subject: Re: [Mipshop] Gauging interest in official WG adoption of IDs

	 
	I do note that
	
	-gabriel
	
	----- Original Message ----
	From: Alper Yegin <[email-masked]>
	To: gabriel montenegro <[email-masked]>; "Faccin, Stefano M" <[email-masked]>; [email-masked]
	Sent: Tuesday, July 25, 2006 3:26:57 PM
	Subject: RE: [Mipshop] Gauging interest in official WG adoption of IDs

	Hi Gabriel,
	
	My comments inlined.

	 

	 

	
	Thanks.
	
	Alper
	
	-gabriel
	----- Original Message ----
	From: Alper Yegin <[email-masked]>
	To: "Faccin, Stefano M" <[email-masked]>; [email-masked]
	Sent: Tuesday, July 25, 2006 10:26:28 AM
	Subject: RE: [Mipshop] Gauging interest in official WG adoption of IDs
	 
	Stefano,
	 
	Regarding the HMIPv6 security solution… Can you conform whether the WG is
	open to consider alternative solutions even after one (below) is accepted as
	a WG document? Or, has the WG decided to pick one solution and stop there?
	 
	Alper

	Hi,

	 
	Thanks,
	 
	Stefano M. Faccin

---

From: Wassim Haddad <[email-masked]>
Date: Wed, 26 Jul 2006 21:40:45 +0300 (EEST)

On Wed, 26 Jul 2006, Narayanan, Vidya wrote:

> However, there may be less motivation to use anything other than
> IKEv2/IPsec for HMIP than for FMIP

=> it would be helpful if you can explain why there is less motivation
to use solutions other than IKEv2/IPsec, e.g., the one described in
the HMIPsec draft.

Wassim H.

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Wed, 26 Jul 2006 15:23:07 -0700

Hi Wassim,
I need to re-read your draft (don't recall the solution at the moment),
but the point I was making was that IKEv2/IPsec works well for HMIP,
given that you are not changing MAPs frequently enough for this to be a
problem. 

The way I see it is this - if there is indeed a motivation to do
anything but IKEv2/IPsec for HMIP, the same motivation potentially can
be applied to MIP6 as well. At this point, I'm not seeing one. 

Vidya 

> -----Original Message-----
> From: Wassim Haddad [mailto:[email-masked]] 
> Sent: Wednesday, July 26, 2006 11:41 AM
> To: Narayanan, Vidya
> Cc: gabriel montenegro; Alper Yegin; Faccin, Stefano M; 
> [email-masked]
> => it would be helpful if you can explain why there is less 
> motivation to use solutions other than IKEv2/IPsec, e.g., the 
> one described in the HMIPsec draft.
> 
> 
> Wassim H.
> 
>

---

From: "Alper Yegin" <[email-masked]>
Date: Fri, 28 Jul 2006 00:28:11 -0700

Here: http://yegin.org/mipshop/draft-yegin-hmip-sa-00.txt

Typing up the I-D seemed more efficient than trying to explain it in an
e-mail.

Alper

________________________________________
From: Narayanan, Vidya [mailto:[email-masked]] 
Sent: Wednesday, July 26, 2006 10:35 AM
To: gabriel montenegro; Alper Yegin; Faccin, Stefano M; [email-masked]
Subject: RE: [Mipshop] Gauging interest in official WG adoption of IDs

draft-vidya-handover-keys-aaa-03 describes a protocol that allows single
roundtrip AAA-based keying that can generically be used between two entities
(e.g., MN and MAP). No changes should be needed in the protocol itself for
this. At the time of writing the document, the need for FMIP was more
urgently identified and hence, the document describes the protocol as
running between the MN and the AR. 

However, there may be less motivation to use anything other than IKEv2/IPsec
for HMIP than for FMIP - for FMIP, doing IKEv2 with every AR is too
expensive. For HMIP, the MN doesn't change a MAP that frequently. Also,
given that new MAPs can be discovered while still attached to the current
MAP, I feel it should be okay to say that IKEv2/IPsec is the recommended
solution. The credential problem is solved using EAP in IKEv2 as well,
thereby fitting the AAA-based credential usage model. 
 
Alper, do you feel the need for something more efficient than IKEv2 for
HMIP? 
 
Vidya

________________________________________
From: gabriel montenegro [mailto:[email-masked]] 
Sent: Tuesday, July 25, 2006 6:31 PM
To: Alper Yegin; Faccin, Stefano M; [email-masked]
Subject: Re: [Mipshop] Gauging interest in official WG adoption of IDs
Sure, the document can be renamed if it ends up talking about stuff other
than what it does currently.
The title should reflect what the content ends up being. Don't need to
decide that now.
 
As for AAA for HMIPv6, it seems like someone must have talked about this,
but I'm drawing a blank.
Does anybody remember?
 
I do note that
http://tools.ietf.org/wg/mipshop/draft-vidya-mipshop-handover-keys-aaa-03.tx
t mentions the possibility of
reusing those keys for HMIP as well, but offers no further details. Vidya? 
-gabriel
----- Original Message ----
From: Alper Yegin <[email-masked]>
To: gabriel montenegro <[email-masked]>; "Faccin, Stefano
M" <[email-masked]>; [email-masked]
Sent: Tuesday, July 25, 2006 3:26:57 PM
Subject: RE: [Mipshop] Gauging interest in official WG adoption of IDs
Hi Gabriel,

My comments inlined.

 

 

Thanks.

Alper

-gabriel
----- Original Message ----
From: Alper Yegin <[email-masked]>
To: "Faccin, Stefano M" <[email-masked]>; [email-masked]
Sent: Tuesday, July 25, 2006 10:26:28 AM
Subject: RE: [Mipshop] Gauging interest in official WG adoption of IDs
 
Stefano,

Alper

Hi,

 
Thanks,
 
Stefano M. Faccin

---

From: Lakshminath Dondeti <[email-masked]>
Date: Fri, 28 Jul 2006 12:35:15 -0700

Hi Alper,

I had a chance to review your draft.  Although 
some of my comments below may indicate the 
differences in thought we might have on the 
topic, we are probably pretty close in the overall direction.

Let me first summarize my understanding of what you are proposing.

Key derivation:
An HMIP-Key is derived from the EAP keying 
hierarchy.  That with lifetime, identity and 
other parameters forms the HMIP-SA.  The HMIP-Key 
is derived from the Master session key from an earlier EAP authentication.

Key delivery:
NAS delivers the HMIP-Key and SA to the MAP.

Key usage:
The HMIP-Key is used with IKEv2 or the AUTH protocol 4285.

Here are my thoughts on the proposal:
Starting in the reverse order, I don't think 
4285's applicability statement applies and so 
that should be dropped from consideration.

I don't think the NAS should be involved in the 
key delivery.  My (limited) understanding of 4140 
tells me that the MAP is deeper in the network 
than a typical NAS and as noted in my review of 
draft-haddad-mipshop-hmipv6-security, the NAS as 
an edge entity is more vulnerable to 
compromise.  Instead, the AAA server might 
deliver the key to the MAP.  It is also plausible 
that the MAP uses IKEv2-EAP as is.  There is no reason to disallow that model.

I am fine with the notion of using a key from the 
EAP keying hierarchy for IKEv2 
authentication.  However, I don't think we should 
use the MSK for the key derivation.  Instead a 
key from the EMSK hierarchy might be used.   We 
can discuss the specifics in detail if you want.

Finally, have you thought about a middle ground 
between IKEv2 and the AUTH protocol.  As I noted 
in my other review, is a DH-based protocol really necessary?

regards,
Lakshminath

---

From: Wassim Haddad <[email-masked]>
Date: Sat, 29 Jul 2006 00:05:29 +0300 (EEST)

Hi Vidya,

> given that you are not changing MAPs frequently enough for this to be a

=> I think it would be really useful to read the draft first!
It is also very useful to read the discussion around the solution based on
IKEv2/IPsec related to HMIPv6, why there is an item related to HMIPv6
security in the new Mipshop agenda and finally why the draft exists.

Wassim H.

---

From: "Alper Yegin" <[email-masked]>
Date: Sat, 29 Jul 2006 00:47:32 -0700

> than a typical NAS 

In my understanding, MAP is part of the "access network", not the "home
network." For that, putting aside the physical and topological aspects, from
"administrative domain" aspect NAS and MAP are the part of the same network.

> can discuss the specifics in detail if you want.

Why do you think so?

We proposed use of MSK because we assume MAP and NAS are part of the same
administrative domain. NAS can generate the HMIP-SA and pass it to the MAP.
Use of EMSK would have been more appropriate if MAP were part of the home
network along with the HAAA server.

Alper

---

From: Lakshminath Dondeti <[email-masked]>
Date: Sat, 29 Jul 2006 09:27:37 -0700

Hi Alper,

Thanks for your response.  Please see inline:

>"administrative domain" aspect NAS and MAP are the part of the same network.

NAS is an edge entity and thus vulnerable to compromise, more so than 
say the MAP or a AAA server (yes, I am keeping in mind the visited 
domain AAA server and the home AAA server).  MAP is deeper in the 
network and would probably be harder to even get physical access 
to.  So, if the NAS were to be compromised, a key shared by an MN and 
MAP will be compromised, right?

There might be practical aspects as well.  I am wondering if the NAS 
is engaging in key delivery, does it have to be a AAA server?  In the 
EAP model the NAS is a AAA client, AFAIK.

>network along with the HAAA server.

So, the MSK, or portions thereof are used as the PMK and other keys 
(e.g., R0-Key in TGr).  Your proposal suggests to use the same key 
for HMIP key derivation.  This is against the cryptographic principle 
that the same key must not be used for different purposes.

If we can turn back the clock on the MSK usage and define a MSK 
hierarchy where keys for purposes other than access can be derived, 
that might have been an alternative.  However, that is generally 
deemed not practical.

There is a way to use the EMSK even in the visited domain 
scenario.  Vidya and I wrote about this briefly in draft-dondeti-eapext-ps-00.

regards,
Lakshminath