Subject: Re: Text Proposal for Compromised MAG issue (was [netlmm]Reviewofdraft-ietf-netlmm-proxymip6-05)

From: Behcet Sarikaya <[email-masked]>
Date: Mon, 1 Oct 2007 09:14:55 -0700 (PDT)

A compromised router, e.g. compromised MAG is recognized as an important threat to the security of PMIP6 network and however, the details of actual mechanisms of how to deal with such a threat are out of scope.

How about the above statement in Security Considerations section?

Regards,

Behcet

----- Original Message ----
From: Ahmad Muhanna <[email-masked]>
To: "Narayanan, Vidya" <[email-masked]>; Sri Gundavelli <[email-masked]>; Wassim Haddad <[email-masked]>
Cc: DE JUAN HUARTE FEDERICO <[email-masked]>; netlmm <[email-masked]>
Sent: Saturday, September 29, 2007 11:45:34 AM
Subject: RE: Text Proposal for Compromised MAG issue (was [netlmm]Reviewofdraft-ietf-netlmm-proxymip6-05)

Hi Vidya,

I do not see any problem in an explicit out-of-scope text. Here is the
updated text:

"
   To address the threat related to a compromised mobile access gateway,
   the local mobility anchor, before accepting a Proxy Binding Update
   message for a given mobile node, may ensure that the mobile node is
   definitely attached to the mobile access gateway that sent the proxy
   binding registration request.  This may be accomplished by contacting
   a trusted entity which is able to track the mobile node current point
   of attachment or validate the provided mobile node signature.
   However, the details of actual mechanisms are out of scope.
"

Regards,
Ahmad

> -----Original Message-----
> From: Narayanan, Vidya [mailto:[email-masked]] 
> Sent: Saturday, September 29, 2007 11:08 AM
> To: Muhanna, Ahmad (RICH1:2H10); Sri Gundavelli; Wassim Haddad
> Cc: DE JUAN HUARTE FEDERICO; netlmm
> Subject: RE: Text Proposal for Compromised MAG issue (was 
> [netlmm]Reviewofdraft-ietf-netlmm-proxymip6-05)
> 
> Hi Ahmad,
> This text is fine with me. I'd still like to explicitly state 
> the actual mechanisms are out of scope.  One more minor nit 
> in the text:
> s/eliminate the threat/deal with the threat - I don't believe 
> we are eliminating the threat itself.. We are talking about 
> mitigating the impact of the threat. 
> 
> Thanks,
> Vidya
> 
> > -----Original Message-----
> > From: Ahmad Muhanna [mailto:[email-masked]]
> > Sent: Saturday, September 29, 2007 7:21 AM
> > To: Sri Gundavelli; Narayanan, Vidya; Wassim Haddad
> > Cc: DE JUAN HUARTE FEDERICO; netlmm
> > Subject: RE: Text Proposal for Compromised MAG issue (was
> > [netlmm]Reviewofdraft-ietf-netlmm-proxymip6-05)
> > 
> > 
> > Sri/Vidya and All,
> > 
> > I believe that we need to stay away from details of how this 
> > compromised MAG issue can be solved. The reason behind this 
> is that, 
> > in the future, and after a thorough investigation of this 
> issue, the 
> > final solution may contradict with the proposed details. 
> Having said 
> > that I would recommend removing all examples and keep enough 
> > informative text which does the
> > following:
> > 
> > 1. Acknowledge the problem
> > 2. Recognize that this issue is not a show stopper and can be 
> > addressed by future work item if at all necessary.
> > 3. Provide informative text which capture the high level 
> indication of 
> > a possible solution.
> > 
> > Based on this, I would recommend the following text:
> > 
> > "
> >    To eliminate the threats related to a compromised mobile access
> >    gateway, the local mobility anchor, before accepting a Proxy 
> > Binding
> >    Update message for a given mobile node, may ensure that 
> the mobile
> >    node is definitely attached to the mobile access gateway 
> that sent
> >    the proxy binding registration request. This may be 
> accomplished by
> >    contacting a trusted entity which is able to track the 
> mobile node
> >    current point of attachment or validate the provided mobile node
> >    signature.
> > "
> > 
> > Thanks.
> > 
> > Regards,
> > Ahmad
> >  
> > 
> > > -----Original Message-----
> > > From: Sri Gundavelli [mailto:[email-masked]]
> > > Sent: Friday, September 28, 2007 8:47 PM
> > > To: 'Narayanan, Vidya'; Muhanna, Ahmad (RICH1:2H10); 
> 'Wassim Haddad'
> > > Cc: 'DE JUAN HUARTE FEDERICO'; 'netlmm'
> > > Subject: RE: Text Proposal for Compromised MAG issue (was
> > > [netlmm]Reviewofdraft-ietf-netlmm-proxymip6-05)
> > > 
> > > It looks fine, except for the CGA part. The CGA 
> generation requires 
> > > the IPv6 subnet prefix and that the mobile node in a Proxy
> > Mobile IPv6
> > > domain would not have it before the signaling is 
> complete. So, the 
> > > mobile node would not be able to assert the address ownership or 
> > > infact even generate an address until the MAG completes the
> > signaling. 
> > > This may work for subsequent registrations, but not 
> during initial 
> > > attachment in Proxy Mobile IPv6 domain. So, I suggest
> > taking out the
> > > CGA part and close this issue.
> > > 
> > > Thanks Ahmad for the text.
> > > 
> > > 
> > > Sri
> > > 
> > > 
> > >  
> > > 
> > > > -----Original Message-----
> > > > From: Narayanan, Vidya [mailto:[email-masked]]
> > > > Sent: Friday, September 28, 2007 5:03 PM
> > > > To: Ahmad Muhanna; Wassim Haddad
> > > > Cc: DE JUAN HUARTE FEDERICO; netlmm
> > > > Subject: RE: Text Proposal for Compromised MAG issue (was
> > > > [netlmm]Reviewofdraft-ietf-netlmm-proxymip6-05)
> > > > 
> > > > All,
> > > > The text proposed by Ahmad mostly looks fine to me,
> > > although it may be
> > > > worthwhile providing a hint for how one may do it in a
> > > non-AAA based
> > > > system.  How about the following (I've taken Ahmad's text
> > and made
> > > > some minor changes/additions):
> > > > 
> > > > "To deal with threats related to a compromised mobile
> > > access gateway,
> > > > the local mobility anchor, before accepting a Proxy
> > Binding Update
> > > > message for a given mobile node, may choose to ensure that
> > > the mobile
> > > > node is definitively attached to the   mobile access 
> > > gateway that sent
> > > > the binding registration request.  This may be done by
> > contacting a
> > > > trusted entity which tracks the MN current point of
> > > attachment, e.g. a
> > > > AAA server (as a result of an authentication exchange
> > with the MN).
> > > > This may also be accomplished by verification of a live
> > > signature from
> > > > the MN, e.g., a CGA signature.  Details of how such
> > verification of
> > > > the MN's point of attachment is done is outside the 
> scope of this 
> > > > specification."
> > > > 
> > > > I've tried to stay away from any normative language in 
> the text, 
> > > > indicating that we are merely providing examples.
> > > > 
> > > > Thanks,
> > > > Vidya
> > > > 
> > > > > -----Original Message-----
> > > > > From: Ahmad Muhanna [mailto:[email-masked]]
> > > > > Sent: Friday, September 28, 2007 10:51 AM
> > > > > To: Wassim Haddad
> > > > > Cc: DE JUAN HUARTE FEDERICO; netlmm
> > > > > Subject: RE: Text Proposal for Compromised MAG issue (was
> > > [netlmm]
> > > > > Reviewofdraft-ietf-netlmm-proxymip6-05)
> > > > > 
> > > > > Hi Wassim,
> > > > > 
> > > > > To be honest, the least to be said about all of this
> > > compromised MAG
> > > > > discussion/issue is: May be not necessary and probably a
> > > lot of time
> > > > > is wasted:-( I am sorry I misunderstood what you were
> > > trying to say
> > > > > earlier, But yes, I see it much clearer now.
> > > > > 
> > > > > One more comment inline.
> > > > > 
> > > > > Cheers:)
> > > > > 
> > > > > Regards,
> > > > > Ahmad
> > > > >  
> > > > > 
> > > > > > -----Original Message-----
> > > > > > From: Wassim Haddad [mailto:[email-masked]]
> > > > > > Sent: Friday, September 28, 2007 12:31 PM
> > > > > > To: Muhanna, Ahmad (RICH1:2H10)
> > > > > > Cc: DE JUAN HUARTE FEDERICO; Sri Gundavelli; netlmm
> > > > > > Subject: RE: Text Proposal for Compromised MAG issue (was
> > > > [netlmm]
> > > > > > Review ofdraft-ietf-netlmm-proxymip6-05)
> > > > > > 
> > > > > > Hi Ahmad,
> > > > > > 
> > > > > > On Fri, 28 Sep 2007, Ahmad Muhanna wrote:
> > > > > > 
> > > > > > > [Ahmad]
> > > > > > > So, can I read this that you think it is impossible and
> > > > > > does not make sense?
> > > > > > 
> > > > > > => Not at all!  Am saying that having the AAA involved to
> > > > > tell the LMA
> > > > > > about the MN's whereabouts paves the way to provide other
> > > > features.
> > > > > > 
> > > > > > >> then you can simply let the LMA updates the MAG
> > > (instead of the
> > > > > > >> opposite)
> > > > > > 
> > > > > > > but I am willing to listen to your theory in a
> > > separate thread!
> > > > > > 
> > > > > > => Yes sure. But let summarize it again in few words:
> > > > > > the AAA can tell the LMA where the MN is following a
> > successful
> > > > > > authentication, i.e., at a very early stage, which in turn
> > > > > enables the
> > > > > > LMA to send a PBU to the MAG and updates it with what the
> > > > > MAG needs to
> > > > > > know.
> > > > > 
> > > > > [Ahmad]
> > > > > Very interesting!
> > > > > 
> > > > > > 
> > > > > > In the same PBU, the LMA can include a secret which can be
> > > > > used by the
> > > > > > MAG to provide SeND features to the MN without CGA (so you
> > > > > don't need
> > > > > > CGA).
> > > > > > 
> > > > > > > [Ahmad]
> > > > > > > Just FYI:
> > > > > > > 1. A detailed solution for the so called 
> compromised MAG is
> > > > > > out-of-scope.
> > > > > > 
> > > > > > => Agree. But from the above you can see that we don't need
> > > > > to create
> > > > > > such problem from the beginning and then claim that it
> > > is out of
> > > > > > scope...
> > > > > > 
> > > > > > > 2. The text hint including the AAA has been proposed
> > > > > several times
> > > > > > > before on the ml by different people.
> > > > > > 
> > > > > > => which I also agree with and am trying to strech its
> > > > > impact on other
> > > > > > features.
> > > > > > 
> > > > > > 
> > > > > > Wassim H.
> > > > > > 
> > > > > 
> > > > > 
> > > > > _______________________________________________
> > > > > netlmm mailing list
> > > > > [email-masked]
> > > > > https://www1.ietf.org/mailman/listinfo/netlmm
> > > > > 
> > > > 
> > > > 
> > > > _______________________________________________
> > > > netlmm mailing list
> > > > [email-masked]
> > > > https://www1.ietf.org/mailman/listinfo/netlmm
> > > 
> > 
> 

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm