Subject: RE: [mobile-ip] Comments on security requirements draft

From: "Patil Basavaraj (NET/Dallas)" <[email-masked]>
Date: Wed, 17 Oct 2001 12:41:44 -0500

Michael Thomas [[email-masked]] wrote:
>Pekka Savola writes:
> > > Plus, every time it is mentioned, it MUST be made very
> > > clear that the threat DOES NOT EXIST in current (or past!)
> > > Mobile IPv6 specification revisions.  Otherwise I fear
> > > we will be diverted towards chasing problems that are not
> > > there.
> > 
> > How do you expect the implementors to handle this?  To make MIPv6
useful,
> > binding updates are pretty much needed (or are they?).  They must be
> > authenticated by the spec.  In practise authentication cannot be
done, and
> > thus no binding updates are possible in general case.
>
>   Right. This is unhelpful at best, and an
>   equivocation at worst. Trying to play spin
>   control on the draft serves no purpose.
>

I believe we are working on engineering (iEtf) a solution to the
problem. "Spin control" (at least the way I understand it) is not
something that this WG should be spending cycles on. Please do not
(mis)read someones valid comments as being anything else. Lets keep
the discussion on finding a solution to the BU problem. Everyone is
entitled to their opinions, but this discussion list is for debating
the technical aspects of Mobile IP.
  
>	   Mike

-Basavaraj

---

From: Michael Thomas <[email-masked]>
Date: Wed, 17 Oct 2001 10:57:34 -0700 (PDT)

> the technical aspects of Mobile IP.

   Uh, I'm not the one who's trying to play the
   spin control game here. I'm saying that the
   current requirements draft is fine as-is in
   this respect. If you have a problem with this,
   you should take it up with the person who
   insists on obscuring the fact that the current
   MIPv6 draft isn't problematic on the BU
   authentication/authorization front. I'm not 
   the only one who has commented on this.

   And I've already sent comments on the draft
   about two weeks ago, for which the authors
   have not replied.

	    Mike

---

From: "T.J. Kniveton" <[email-masked]>
Date: Wed, 17 Oct 2001 13:14:31 -0700

>    about two weeks ago, for which the authors

Is there anyone who disagrees with this self-evident fact that there are
problems and challenges with doing authentication and authorization in a
mobile environment? I haven't heard any argument on this point. No one
is trying to "obscure" this facet of our engineering work or put spin
control on it.

There seems to be a question on whether we should try and solve every
problem associated with strong, scalable encryption technology, key
distribution, IPsec, etc., and create a perfect, rock-solid, ideal
system which solves all of the problems the Security-oriented engineers
have been working on for years (or paddle toward that end indefinitely),
or we should instead get a good solution that works, is implementable
and deployable, and doesn't screw up other parts of IPv6. The consensus
is NO, we do not want to do the former, we want to do the latter, as is
shown by the eagerness of various members in the group who have done a
lot of constructive work to reach a compromise solution that is as good
as possible using current security technology and practices (and a
couple of novel ones). And by the way, let's do it some time this
decade.

Solving all the key distribution, trust, and strong encryption problems
is a really interesting question, and I will personally dance around the
room and host a jubilant party once they are solved. So let's bring
these research tasks to the IRTF, or somewhere there is  some chance
they could get properly addressed without derailing their current work.

-TJ

-- 
        T.J. Kniveton 
  Communications Systems Lab
     Nokia Research Center