Subject: [Mipshop] FMIP SA indexing

From: "Alper Yegin" <[email-masked]>
Date: Mon, 7 Aug 2006 15:52:04 +0300

I missed the MIPSHOP meeting. Reading the meeting minutes (below), let me append my own comments.

SPI is a good way to distinguish the SAs, especially indexing the pre-shared key. Whatever mechanism(s) we end up using for dynamically generating the SAs, it better also generate/agree on an SPI between the MN and AR. This is a MUST especially when more than one SA (or key) may be present at a given time (e.g., a new key is generated before the currently used one has expired).

As an example, see the HMIP Security I-D draft-yegin-hmip-sa-00.txt. We'll produce another version of the document for FMIPv6 security (which we expect to be nearly identical). 

One thing though... The current I-D takes over the whole SPI space. If we end up supporting multiple mechanisms, or want to be future-proof, we need to make sure we don't end up with SPI collisions among different mechanisms.

Alper

- If a new HKE is to be defined, relies on reserving an SPI value. Is this a good idea?

Remove the AT field?

Yes, AT is set by the key derivation mechanism (AAA, SEND)

Hesham: wondering whether it's useful to include this in MIP signaling at all.

Rajeev: when you send FBU with this option, how does the router know which type of key?

Hesham: aren't these bits added specifically for fast handover?

Rajeev: yes, it is going to be part of the FMIP option?

Hesham: you've already told the router that you want to use SEND

Vidya: based on what you did earlier to derive the key, (SEND vs. AAA) when you are sending the FBU, you're either using

Hesham: are you assuming the MN will use multiple methods at the same time?

Vidya: at the time of FBU processing, the AR needs to find the key

Hesham: the key should already be installed

Rajeev: the AR could use AAA for some and SEND for others. Even using IP address alone you should be able to find the key

Vidya: at the time the key was established, you can use the SPI

Rajeev: AAA based scheme uses NAI not IP address

Hesham: you're going to map the NAI to an IP address, which the AR will know.

Rajeev: so what should we do?

Vijay: in SEND, can you go back to indexing the SA with SPI? That SA will tell you what keys to use.

Vidya: it can be done, but it was felt that it wasn't necessary since IP address is available at the time.� If MN ping-pongs, it would be nice to keep the key around and use the valid Sas for as long as the lifetime is valid

Hesham: don't think that would be a good reason. The AR is keeping state for a while. That state could be address.

Vidya: but you could be changing the IP address

Hesham: you don't need two parameters for it

Rajeev: Handover key exchange field can be one of the mechanisms, algorithm Type may not be needed.

Agree to keep HKE but remove AT field

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop