Subject: RE: [mobile-ip] Security Requirements Draft

From: "Qiang Zhang" <[email-masked]>
Date: Mon, 1 Oct 2001 22:12:03 -0400

Charlie and all,
	 
	Do you think it may be useful to define a mode in the MIPv6 base
for the MN to choose using rev-tunnel only? That way it may be
beneficial to some usage models, for example, to achive MN's location
privacy (no BU sent to CN, neither from HA nor MN) and also controlled
access policy can be imposed for the MN from home network.
	 
	Or would this be left to implementations to define its own? 
	 
	Thanks
	Qiang
	 
	-----Original Message----- 
	From: Charles E. Perkins 
	Sent: Mon 10/1/2001 11:36 AM 
	To: Francis Dupont 
	Cc: [email-masked] 
	Subject: Re: [mobile-ip] Security Requirements Draft

	Hello Francis,
	
	Your solution is already supposed to be "in there", because the
	home agent is required to be able to decapsulated packets from
	the mobile node.  If this point has somehow been lost since the
	time I was originally editing the document, I will make sure
that
	it gets restored to the text.  Thus, I don't think there is
anything
	to be done, unless you would like to have an appendix that
points
	out explicitly that home agent decapsulation is valuable for use
	with mobile nodes that don't wish to use the Home Address
destination
	option.
	
	Also, I would like to point out that the Home Address
destination
	option was designed NOT to be a threat to ingress filtering,
because
	the home address of the sender is right there!  Putting your
true
	address into the packet is a very bad way to hide.  If the worry
	has something to do about using the care-of address, then it has
	nothing to do with Mobile IPv6 anyway, because any node can
	autoconfigure a topologically correct address that would look
	indistinguishable from the mobile node's use of such a
topologically
	correct address.
	
	Regards,
	Charlie P.

	Francis Dupont wrote:
	>
	>    I would like to float another proposed assumption and get
feedback on this.
	>
	>    3> That there is some sort of SA (perhaps dynamically
created at initial
	>    access) between the ARs and the MN in the visited subnet.
	>
	> => I don't think this is a good idea because :
	>  - this is hard in some cases to get this SA
	>  - mobile IPv6 draft has "access control for visited networks"
in non-goals.
	>
	> But of course the existence (or not) of this SA is important
for
	> some threats, so my concern is only about an assumption.
	>
	> Regards
	>
	> [email-masked]
	>
	> PS: about the other "drop everything (:-)" thread: I disagree
the only
	> simple solution is to drop everything but I'd like to see the
	> anti-optimized/reverse-tunneling solution in mobile IPv6
document
	> because this is both simple and very secure.

---

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Tue, 2 Oct 2001 13:52:30 +1000

Hi, 

I thought that section existed already, but now it seems that 
rev 14 only has that section in the HA operation part. Ch 9.5

As far as the MN is concerned it's really an internl policy
decision within the MN itself and doesn't have protocol 
impacts. 
Last time I worked on our implementation we had a 
configuration option for this in the MN. 

Maybe some text for the MN operation would help clarify
that it is a configuration / policy issue for the MN.

Cheers,
Hesham

> From:	Qiang Zhang [SMTP:[email-masked]]
> Sent:	Tuesday, 2 October 2001 12:12
> To:	[email-masked]
> Subject:	RE: [mobile-ip] Security Requirements Draft
> 
>  
>  
>  
> 
> 	Charlie and all,
> 	 
> 	Do you think it may be useful to define a mode in the MIPv6 base for
> the MN to choose using rev-tunnel only? That way it may be beneficial to
> some usage models, for example, to achive MN's location privacy (no BU
> sent to CN, neither from HA nor MN) and also controlled access policy can
> be imposed for the MN from home network.
> 	 
> 	time I was originally editing the document, I will make sure that
> 	it gets restored to the text.  Thus, I don't think there is anything
> 	to be done, unless you would like to have an appendix that points
> 	Also, I would like to point out that the Home Address destination
> 	option was designed NOT to be a threat to ingress filtering, because
> 	the home address of the sender is right there!  Putting your true
> 	indistinguishable from the mobile node's use of such a topologically
> 	correct address.
> 	
> 	Regards,
> 	Charlie P.
> 	
> 	
> 	
> 	Francis Dupont wrote:
> 	>
> 	>    3> That there is some sort of SA (perhaps dynamically created
> at initial
> 	>  - mobile IPv6 draft has "access control for visited networks" in
> non-goals.
> 	>
> 	> But of course the existence (or not) of this SA is important for
> 	> PS: about the other "drop everything (:-)" thread: I disagree the
> only
> 	> anti-optimized/reverse-tunneling solution in mobile IPv6 document

---

From: Gregory Daley <[email-masked]>
Date: Tue, 02 Oct 2001 15:22:58 +1000

>        Do you think it may be useful to define a mode in the MIPv6 
> basefor the MN to choose using rev-tunnel only? That way it may be

	Hi Qiang,

	Some mechanisms to provide this function are indicated
	in the HMIPv6 draft, which provides a location privacy
	Section 6.6 (+6.5)

	This may not be the same tool I think it is 
	intended to solve the same problem. (for example,
	if a MAP is also the HA) 

	Perhaps it is better to have the function only mandated
	once so that MIPv6 doesn't expand further.

		Greg Daley

---

From: "Qiang Zhang" <[email-masked]>
Date: Tue, 2 Oct 2001 22:24:25 -0400

-----Original Message----- 
	From: Gregory Daley 
	Sent: Tue 10/2/2001 1:22 AM 
	To: [email-masked] 
	Cc: [email-masked] 
	Subject: Re: [mobile-ip] Security Requirements Draft

	        Hi Qiang,

	
	
	                Greg Daley
	                       
	=>   Greg, thank you for pointing it out. I understand that by
manipulating the LCoA and RCoA a tunnel between MAP and MN can be set up
so that the MN's mobility is hidden between MN and MAP, which is the
"reverse-tunnel/anti-optimization" mode being tossed around. I saw a few
flags in HMIPv6 so is it safe to assume that the "rev-tunnel" can be
negotiated between the MN and MAP?  Do you see the same thing in the
MIPv6 too?  Sorry I missed the latest draft, if the capability to
negotiate the "rev-tunnel" mode is in place, that would be nice.

	Qiang

---

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Wed, 3 Oct 2001 16:26:11 +1000

Qiang,
> negotiated between the MN and MAP?  
> 
		=> There is currently no reverse tunnelling in the draft
between the 
		MN and the MAP. Location privacy is allowed by allowing the 
		user to use RCoA as a src address instead of LCoA. This is 
		only applicable to Basic mode MAPs.

> Do you see the same thing in the MIPv6 too?  
> 	 
		In MIPv6 draft 14, the HA MUST allow reverse tunnelling
		(ch 9.5). So all the MN needs to do is simply reverse 
		tunnel and the HA support is expected. No negotiations
		are required. 

		Hesham

---

From: "Qiang Zhang" <[email-masked]>
Date: Wed, 3 Oct 2001 10:09:32 -0400

Hesham,
 
            Thanks for clarifying, I remember the earlier draft can
allow HA to send BU to a CN. If that is removed, then a bi-directional
tunnel can be set up upon MN's decision.  Sorry for that confusion
            
            Qiang

 -----Original Message-----
From: Hesham Soliman (EPA) [mailto:[email-masked]]
Sent: Wednesday, October 03, 2001 1:26 AM
To: [email-masked]'
Subject: RE: [mobile-ip] Security Requirements Draft

	Qiang, 

	=> There is currently no reverse tunnelling in the draft between
the 
MN and the MAP. Location privacy is allowed by allowing the 
user to use RCoA as a src address instead of LCoA. This is 
only applicable to Basic mode MAPs. 

[Qiang Zhang] 

	Hesham