Subject: Re: [netlmm] #113: Rename/Redefine "Network Access Identity"

From: netlmm <[email-masked]>
Date: Tue, 08 Aug 2006 07:00:32 -0000

#113: Rename/Redefine "Network Access Identity"
----------------------------------------+-----------------------------------
  Reporter:  [email-masked]           |       Owner:  [email-masked]       
      Type:  defect                     |      Status:  assigned               
  Priority:  major                      |   Milestone:  milestone1             
 Component:  draft-ietf-netlmm-threats  |     Version:  2.0                    
Resolution:                             |    Keywords:  Network Access Identity
----------------------------------------+-----------------------------------
Changes (by [email-masked]):

  * status:  new => assigned

-- 
Ticket URL: <http://www1.tools.ietf.org/wg/netlmm/trac/ticket/113>
netlmm <http://tools.ietf.org/wg/netlmm/>
_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: netlmm <[email-masked]>
Date: Tue, 08 Aug 2006 07:00:25 -0000

#113: Rename/Redefine "Network Access Identity"
---------------------------------------+------------------------------------
 Reporter:  [email-masked]           |       Owner:  [email-masked]
     Type:  defect                     |      Status:  new             
 Priority:  major                      |   Milestone:  milestone1      
Component:  draft-ietf-netlmm-threats  |     Version:  2.0             
 Keywords:  Network Access Identity    |  
---------------------------------------+------------------------------------
 Lakshminath Dondeti:

  ''In Section 1.1, the definition of network access identity
 needs to be revised.  In fact, that term itself is overloaded in this
 draft and needs to be changed.  NAI is a well-known term and what's
 being defined in the threats document is a new notion and needs a new
 term.  The MAG is concerned about whether an MN is authorized to use
 its claimed IP address.''

 Proposed solution:  We might need a different terminology for what is now
 the "network
 access identity".  I refrained from using the acronym "NAI" for this
 term, as "NAI" is already used widely for "network access identifier",
 which is something different.  We used the term "mobile-node identity"
 for some time.  How about going back to this wording?

 Related to this:

  ''Section 3.1 needs a revision.

  ''On paragraph 1:  I am not sure I fully understand paragraph 1.  My
 understanding is that NAI and AAA-assisted authentication only
 establish that the MN is authenticated for network access.  There is
 no guarantee that the MN is authorized to use its claimed IP
 address.  We need to define the problem/issue more clearly.

  ''...

  ''On paragraph 2: My main observation is it needs clarification.  I am
 not sure binding between NAI and IP address is required.  I am also
 not sure what binding between the NAI and authentication keys
 associated with the IP address; please clarify.

 Proposed solution:  The paragraph is a bit SEND-specific, I guess.  It
 should better
 approach the issue like this:  The goal is to allow the MAG to securely
 "deduce that the mobile node has handed over onto the MAG's access
 link", so the MAG must be able to securely bind the MN's handoff
 signaling messages (be it at L2 or L3) to the MN's network access
 identity.

 This should already be sufficient; it does not matter at this point
 whether the MAG uses the MN's IP address or something else for MN
 authentication.

 BTW, the paragraph is talking about the "network access identity", not
 the "network access identifier" AKA NAI.  I agree this causes confusion.

---

From: netlmm <[email-masked]>
Date: Mon, 21 Aug 2006 07:06:45 -0000

#113: Rename/Redefine "Network Access Identity"
----------------------------------------+-----------------------------------
  Reporter:  [email-masked]           |       Owner:  [email-masked]       
      Type:  defect                     |      Status:  closed                 
  Priority:  major                      |   Milestone:  milestone1             
 Component:  draft-ietf-netlmm-threats  |     Version:  2.0                    
Resolution:  fixed                      |    Keywords:  Network Access Identity
----------------------------------------+-----------------------------------
Changes (by [email-masked]):

  * resolution:  => fixed
  * status:  assigned => closed

Comment:

 Changed the terminology from "network access identity" to "mobile node
 identity" as the previous term was frequently confused with the different
 "network access identifier" (NAI).

 Removed the special "Network Access Identity" subsection in section 3.
 The mobile node identity is now first mentioned in section 1, which fits
 well with the nutshell description of the NETLMM architecture.  The
 security requirements of the mobile node identifier are discussed in the
 introductory text of section 3.  This makes more sense than a special
 subsection because the text, on one hand, provides the necessary basis to
 understand the following subsections, while on the other hand, it does not
 really explain an attack itself.