Subject: Re: [mobile-ip] Mobile Routers support without optimization

From: James Kempf <[email-masked]>
Date: Wed, 22 Aug 2001 08:56:38 -0700 (PDT)

Thierry,

>>    The problem is that HA may not a) be trustworthy or
>>    b) authoratative. Assuming this knowledge is readily
>>    available anywhere (which I'm not sure), it needs to
>>    be from a trustworthy and authoratative source.
>
>If you claim that HA can not be trusted, then this applies equally well
>to mobile HOSTS, doesn't it ?  As far as standard MIPv6 for mobile HOSTS
>is concerned, an implication of this statement is that solutions like
>BAKE and cie wouldn't give much help for the authorization of the MH to
>send a BU for its home address.  
>
>Just trying to be consistent.

Maybe I'm missing something, but doesn't the MN have a security
association with it's HA? So the MN can trust it's HA. The issue
here is whether the CN can trust the HA, and without a similar
security association, I think Michael's point is correct.

		jak

---

From: Michael Thomas <[email-masked]>
Date: Wed, 22 Aug 2001 09:39:27 -0700 (PDT)

> security association, I think Michael's point is correct.

   Ah. Yes, just because I trust my home agent doesn't
   mean that everybody should trust my home agent. The
   home agent *may* be trustable, but if the CN doesn't
   have any way to differentiate trustworthy ones from
   untrustworthy ones, it doesn't do it much good, and
   must therefore assume it is not trustworthy either.

   What may work here is a UN Security Council like
   approach here where the routers in the path between
   CN and HA inclusive all have absolute veto power
   over any proposal. Only by running this gauntlet
   can any request be accepted.

	   Mike