Subject: Re: [mobile-ip] Concerns about draft-mipv6-14 section 4.8

From: Thierry Ernst <[email-masked]>
Date: Mon, 6 Aug 2001 09:09:29 -0700 (PDT)

--- Michael Thomas <[email-masked]> wrote:
>    Considering that routing table update at a
> distance
>    is a fundamental shift in the current security
>    practices of the internet, I'd say that this is
>    pretty important problem to be considered, and
> may
>    very well be the lynch pin. Indeed, it's quite
> possible
>    that if the requirements are significantly
> different than what is
>    currently being proposed with the varoius return
>    routability test, it's not solvable at all within
> the
>    current MIP design. It would probably be nice to
> know that
>    sooner rather than later.

As far as Mobile IPv6 is concerned toghether with the
process of sending BUs to HA and CNs, yes there is an
AUTHORIZATION issue as previously debated on this
mailing list about one year ago. The authorization
problem is exactly the reason why our draft "Prefix
Scope Binding Updates"
(draft-ernst-mobileip-v6-network-02.txt - sorry that I
keep pointing to my drafts but I don't want the people
to be confused about which draft I am talking about -
there are 2 of them)was not widely accepted, and also
the reason why I advocate any MIPv6 extensions about
network mobility support to be kept away from the
MIPv6 specification.

Anyway, t6here is a section in our draft that is
tackling with the AUTHORIZATION issue.  Our view is
that what we need a certificate that says that a
router is AUTHORIZED to send a BU for a particular
prefix. The section is rather short, but it is here to
open the discussion. I would therefore be more than
happy to have comments on this; that would avoid
everyone to keep repeating and arguying the same
things.  Having feedback on a draft is the reason to
write a draft, If we wanted to keep the discussion for
ourselves we wouldn't have written it.  Then, all you
interested people, please comment on the draft. If
there is something wrong, please speak up.

Thierry.
Motorola Labs and INRIA Rhone-Alpes

__________________________________________________
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/

---

From: Michael Thomas <[email-masked]>
Date: Mon, 6 Aug 2001 10:03:52 -0700 (PDT)

Ok, here's the problem I see. What gives me the
right to assert a routing table modification for a
prefix larger than I'm authorized to route? The
current crop of proposals expect that if I can
route back to where the BU came from (either to
the MN or HA), that is sufficient check to accept
the BU. However, that only guarantees that I can
currently protect one address: the source address
of the BU. Thus if I am a resident on x/8, but am
only authorized for x.y.z/24, I better not be able
to send a BU for x/8. With the current return
routability proposals, I don't believe this is
possible. Nor does having a home agent
*necessarily* help: the home agent may be in
collusion with the MN and not trustable (think
of some script kiddie with their home linux box 
acting as a home agent with their hacked up 
mobile router). 

As far as I can tell, the only thing that
knows about whether the scope is too broad
is some router, potentially serveral hops
upstream, of the home agent. This is a problem.

I'll go on record here as voicing some scalability
concerns with the prospect of large server banks
with potentially large binding caches. These are
essentially unaggregated host routes across the
Internet with is sort of unsettling. This is a
general concern with regular BU's, I'll admit, but
it sort of points out that the CN is not
necessarily the best place to send a BU from a
scaling or messaging standpoint. Indeed, it seems
that the optimal place to send a BU is with the
joining router in the path between the HA and MN's
current CoA.

	    Mike