Subject: RE: [nemo] Re: I-D ACTION:draft-ietf-nemo-ro-space-analysis-00.txt

From: "Pascal Thubert \(pthubert\)" <[email-masked]>
Date: Tue, 6 Sep 2005 15:40:05 +0200

Hi Alex:

Thanks for all this? Great comments :)

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf Of
Alexandru Petrescu
>Sent: Tuesday, September 06, 2005 2:56 PM
>To: [email-masked]
>Subject: [nemo] Re: I-D ACTION:draft-ietf-nemo-ro-space-analysis-00.txt
>
>Hello to authors of draft-ietf-nemo-ro-space-analysis-00.txt and thanks
>for posting this draft.  It captures in a single document much of the
ro
>solution space and possibilities.
>
>I have read it partially and I have a few comments.
>
>I would suggest using the terms "prefix ownership" instead of the mix
>"identity" of "location" for Mobile Routers.  While it is easy to
>understand that the "identity" of a MH is its Home Address it is
>difficult to agree that the MNP is the "identity" of a MR.  It is
easier
>to understand that MR "owns" a certain prefix and the "identity" of
that
>MR is its Home Address.
>>I would suggest not using the terms "implicitly" and "explicitly" for
>the two ways of representing an MNN's identity, because of the
confusion
>that may arise with the terms "implicit" and "explicit" of the NEMO
>modes of operation.  The NEMO Basic Support MR uses "implicit" mode of
>signalling to HA its CoA by _not_ including MNP in the BU and
"explicit"
>mode by including MNP in the BU.  The document on ro space analysis
uses
> "implicitly"  to represent MNP's identity by the use of MNP and
>"explicitly" by the use of its address.
>
>I would suggest to use "identity" to stand for MR's Home Address
>exclusively.
>

[<PT>] Yes, I believe that we have formed the collective understanding
that the Home Address is the ID for the MN/MR and for the associated
binding, when a bunch of various types of information are bound (the HoA
itself, prefixes, IPv4 addresses, DNS names, you name it).

>> Binding Update with Mobile Network Prefix
>>
>> This can be viewed as a logical extension to NEMO Basic Support,
>> where the Mobile Router would send binding updates containing one or
>> more Mobile Network Prefix options to the Correspondent Agent. The
>> Correspondent Agent having received the Binding Update, can then set
>>  up a bi-directional tunnel with the Mobile Router at the current
>> care-of address of the Mobile Router, and inject a route to its
>> routing table so that packets destined for addresses in the mobile
>> network prefix will be routed through the bi-directional tunnel.
>
>Actually I think the packets addressed to nodes in the moving network
>will be routed with a routing header and not encapsulated through a
>bi-directional tunnel.
>
[<PT>] We had in mind that the Correspondent Agent would similarly to a
Home Agent: terminate the tunnel. It would get packets from the
correspondent en encaps them, which is easier then injecting an RH2 in
the middle. 

>> Although the Return Routability procedure allows the Correspondent
>> Agent to verify that the care-of and home addresses of the Mobile
>> Router are indeed collocated, it does not allow the Correspondent
>> Agent to verify the validity of the Mobile Network Prefix.
>
>Right, and additionally it is difficult to design a method for testing
>the return routability for each and every address falling with the MNP
>limits.
>
[<PT>] Yep. RO MR to MR is a very difficult problem to solve in terms of
security. OTOH, proxies doing some degree of RO alleviate a lot of the
difficulty. They share a common trust model with the infrastructure. 

Pascal

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 06 Sep 2005 16:01:39 +0200

> itself, prefixes, IPv4 addresses, DNS names, you name it).

Yes, from a certain perspective within a certain IP mobility space.
Even though in the CGA space it's the private key that is really _the_ ID.

I was thinking "bind" and "bound" are only for Mobile IPv6 binding
management, i.e. a Home Address or an MNP are bound to a Care-of
Address.  That and no more than that.

I was not thinking that one would "bind" an IPv4 address to an IPv6
Care-of Address, nor an IPv4 Care-of Address to an IPv6 Home Address.
6to4 gives a method for converting an IPv4 public address into an IPv6
prefix.

I was not thinking that a HoA would be bound to a DNS name.  Each DNS
FQDN is resolved into an IP address and reversely.

And back to the draft, I'd suggest not using MNP to be an identifier,
but the Home Address.

> Home Agent: terminate the tunnel.

I see, in that case - yes.

Alex