Subject: [Mipshop] Last call for 4140bis - Security comments

From: "Hesham Soliman" <[email-masked]>
Date: Wed, 5 Sep 2007 22:11:28 +1000

Folks, 

A couple of comments were raised during the last call for 4140bis. The one
that generated the most discussion was initially raised by Julien then
discussed with myself, Vidya and others. The issue was whether we need to
mandate the support for EAP with IKEv2 for SA establishment between the MN
and the MAP. 

I'd like to first refresh everyone's memory about the requirements from a
protocol security point of view. HMIPv6, unlike MIPv6, does not require the
allocation of a specific address to a MN. Hence, the authorisation for
setting up a binding is somewhat simpler in HMIPv6. Basically, the only
requirement for a MAP to initially allocate an address for the MN is to make
sure that the address is not already allocated to any other MN. I want to
ietrate that this is the *protocol* requirement and not something that every
deployment must be satisfied with. Based on this requirement, self signed
certificates by the MNs are perfectly accepatable to the MAP. 

Other people have raised the bar for authorisation in the past and said that
some operators might need a specific authorisation for the HMIP "service".
Of course in those cases a self signed cert is not sufficient and either PKI
or EAP/AAA should be used with IKEv2. 

So the question is whether we need to mandate anything at all since the
varying requirements come from deployment points of view and not protocol
needs. 

I hope I can get some opinions from the WG about this. To make it very
clear, here is the question and options for answers:
Should we keep the text in the draft that mandates the support of EAP with
IKEv2? 

Answers:
Yes
No

If you answer 'Yes' then you're basically asking to keep the current draft
unchanged. If you answer 'No' then you're effectively saying that we don't
need to mandate EAP or self signed certificates or PKI and we should leave
it up to deployments to decide. I take it from the recent discussions that
at least Julien and Vidya are answering 'No'. Please correct me if I missed
something. 

Hesham

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "Hesham Soliman" <[email-masked]>
Date: Fri, 14 Sep 2007 15:10:50 +1000

Folks, 

There were no responses to this message. So far Julien and Vidya (and I'll
add myself here) have asked for the change below. Since no one is objecting
I think we should go ahead with the suggestion of not mandating EAP over
IKEv2. 

Hesham 

 > -----Original Message-----
 > From: Hesham Soliman [mailto:[email-masked]] 
 > Sent: Wednesday, September 05, 2007 10:11 PM
 > To: [email-masked]
 > Subject: [Mipshop] Last call for 4140bis - Security comments
 > 
 > Folks, 
 >

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 18 Sep 2007 11:08:14 -0700

Hi Hesham,

> or EAP/AAA should be used with IKEv2. 

I still think this authorization step would be important if we are 
talking about any serious HMIPv6 deployment. If we are removing 
requiring support for EAP on the MAP, I would like to see some text that 
says if a particular deployment requires this authorization step, then 
self-signed certificates are not sufficient and EAP would be required.

Vijay

---

From: "Hesham Soliman" <[email-masked]>
Date: Wed, 19 Sep 2007 10:01:05 +1000

> self-signed certificates are not sufficient and EAP would be 

=> I think such text would be necessary to show when each of those options
are needed. I'll add that to the updated rev.

Hesham

---

From: Vijay Devarapalli <[email-masked]>
Date: Tue, 18 Sep 2007 17:03:23 -0700

> are needed. I'll add that to the updated rev.

Ok, thanks.

Vijay