Subject: [mobile-ip] Dynamic Home Agent Address Discovery mechanism

From: [email-masked]
Date: Fri, 6 Jul 2001 11:34:54 -0500

Hello,

The Mobile IPv6 specification (draft-ietf-mobileip-ipv6-14.txt) defines a
Dynamic Home Agent Address Discovery mechanism (section 10.8): This
mechanism offers more flexibility to the specification by allowing the
mobile node to dynamically find the address of a suitable Home agent on its
Home link. 
The mobile node may not know the address of any router on its home link that
can serve as a home agent for it. Such mechanisms can for example be used
when the router that was operating as the mobile node's home agent is being
reconfigured or has been replaced by a different router serving this role.  

In order to provide the possibility of securing the home-agent discovery
feature when required, the following improvements to the Mobile IPv6
specifications are proposed.
The changes suggested which are a SHOULD and NOT a MUST are:

* the home agents could require the ICMP Home Agent Address Discovery
Request message to be authenticated and they will only reply to valid
requests. Requests that do not pass authentication could be silently
dropped. (or an error message be sent back, but without the source address
being that of a valid home agent) 

* The Home Agent Discovery reply message could be authenticated, and whereas
the currently specified ICMP Home Agent Address Discovery Reply message
contains one or a list of the global unicast IP address of home agent
operating on the home link; this information could be encrypted.   

* Finally the source IP address of the response packet sent to the
originator SHOULD NOT be that of a Home Agent but some virtual address. 
  
Comments are welcome,

Thank you,

Franck

---

From: Michael Thomas <[email-masked]>
Date: Wed, 18 Jul 2001 03:33:56 -0700 (PDT)

> being that of a valid home agent) 

   What is the advantage to early authentication? There
   would be a lot of work to create a self-authenticating
   Discovery Request for little gain that I can see. It
   seems like it would be a whole lot simpler to let the
   HA reply to any discovery request, but require strong
   authentication for its use as a home agent. (ie, 
   discover/authenticate/BU/use).

 > operating on the home link; this information could be encrypted.   

   Again, what is the advantage? BU's are not encrypted, so
   you're going to disclose your choice once you select an
   HA, right?
  
 > originator SHOULD NOT be that of a Home Agent but some virtual address. 

   Virtual in what way? Something that might fail an RPF check?

		Mike