Subject: Re: Text Proposal for Compromised MAG issue (was [netlmm] Reviewofdraft-ietf-netlmm-proxymip6-05)

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 01 Oct 2007 09:42:21 +0200

Narayanan, Vidya wrote:
> All, The text proposed by Ahmad mostly looks fine to me, although it
> may be worthwhile providing a hint for how one may do it in a non-AAA
> based system.

Only a 'hint'??

I thought the basic spec should not rely exclusively on NAI and AAA
presence.  NAI and AAA should come as optimizations, or as local 
deployment-specific assistance for better performance.

Alex

> How about the following (I've taken Ahmad's text and made some minor
> changes/additions):
> 
> "To deal with threats related to a compromised mobile access gateway,
>  the local mobility anchor, before accepting a Proxy Binding Update 
> message for a given mobile node, may choose to ensure that the mobile
>  node is definitively attached to the   mobile access gateway that
> sent the binding registration request.  This may be done by
> contacting a trusted entity which tracks the MN current point of
> attachment, e.g. a AAA server (as a result of an authentication
> exchange with the MN). This may also be accomplished by verification
> of a live signature from the MN, e.g., a CGA signature.  Details of
> how such verification of the MN's point of attachment is done is
> outside the scope of this specification."
> 
> I've tried to stay away from any normative language in the text, 
> indicating that we are merely providing examples.
> 
> Thanks, Vidya
> 
>> -----Original Message----- From: Ahmad Muhanna
>> [mailto:[email-masked]] Sent: Friday, September 28, 2007 10:51
>> AM To: Wassim Haddad Cc: DE JUAN HUARTE FEDERICO; netlmm Subject:
>> RE: Text Proposal for Compromised MAG issue (was [netlmm]
>> Reviewofdraft-ietf-netlmm-proxymip6-05)
>> 
>> Hi Wassim,
>> 
>> To be honest, the least to be said about all of this compromised
>> MAG discussion/issue is: May be not necessary and probably a lot of
>> time is wasted:-( I am sorry I misunderstood what you were trying
>> to say earlier, But yes, I see it much clearer now.
>> 
>> One more comment inline.
>> 
>> Cheers:)
>> 
>> Regards, Ahmad
>> 
>> 
>>> -----Original Message----- From: Wassim Haddad
>>> [mailto:[email-masked]] Sent: Friday, September 28, 2007
>>> 12:31 PM To: Muhanna, Ahmad (RICH1:2H10) Cc: DE JUAN HUARTE
>>> FEDERICO; Sri Gundavelli; netlmm Subject: RE: Text Proposal for
>>> Compromised MAG issue (was [netlmm] Review
>>> ofdraft-ietf-netlmm-proxymip6-05)
>>> 
>>> Hi Ahmad,
>>> 
>>> On Fri, 28 Sep 2007, Ahmad Muhanna wrote:
>>> 
>>>> [Ahmad] So, can I read this that you think it is impossible and
>>>> 
>>> does not make sense?
>>> 
>>> => Not at all!  Am saying that having the AAA involved to
>> tell the LMA
>>> about the MN's whereabouts paves the way to provide other
>>> features.
>>> 
>>>>> then you can simply let the LMA updates the MAG (instead of
>>>>> the opposite)
>>>> but I am willing to listen to your theory in a separate thread!
>>>> 
>>> => Yes sure. But let summarize it again in few words: the AAA can
>>> tell the LMA where the MN is following a successful 
>>> authentication, i.e., at a very early stage, which in turn
>> enables the
>>> LMA to send a PBU to the MAG and updates it with what the
>> MAG needs to
>>> know.
>> [Ahmad] Very interesting!
>> 
>>> In the same PBU, the LMA can include a secret which can be
>> used by the
>>> MAG to provide SeND features to the MN without CGA (so you
>> don't need
>>> CGA).
>>> 
>>>> [Ahmad] Just FYI: 1. A detailed solution for the so called
>>>> compromised MAG is
>>> out-of-scope.
>>> 
>>> => Agree. But from the above you can see that we don't need
>> to create
>>> such problem from the beginning and then claim that it is out of
>>>  scope...
>>> 
>>>> 2. The text hint including the AAA has been proposed
>> several times
>>>> before on the ml by different people.
>>> => which I also agree with and am trying to strech its
>> impact on other
>>> features.
>>> 
>>> 
>>> Wassim H.
>>> 
>> 
>> _______________________________________________ netlmm mailing list
>>  [email-masked] https://www1.ietf.org/mailman/listinfo/netlmm
>> 
> 
> 
> _______________________________________________ netlmm mailing list 
> [email-masked] https://www1.ietf.org/mailman/listinfo/netlmm
> 

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 01 Oct 2007 09:44:18 +0200

Sri Gundavelli wrote:
> It looks fine, except for the CGA part. The CGA generation
> requires the IPv6 subnet prefix and that the mobile node in
> a Proxy Mobile IPv6 domain would not have it before the
> signaling is complete. So, the mobile node would not be able
> to assert the address ownership or infact even generate an
> address until the MAG completes the signaling. This may work
> for subsequent registrations, but not during initial attachment
> in Proxy Mobile IPv6 domain. So, I suggest taking out the CGA
> part and close this issue. 

I agree the CGA part looks problematic, especially since the current 
draft can only  encode HNP, LL address and NAIs as identifiers; whereas 
CGA would need to encode the public key of the node.

I think this should be left out as much as the NAI should be left out, 
as optional and performance enhancement features.

Alex

> 
> Thanks Ahmad for the text.
> 
> 
> Sri
> 
> 
>  
> 
>> -----Original Message-----
>> From: Narayanan, Vidya [mailto:[email-masked]] 
>> Sent: Friday, September 28, 2007 5:03 PM
>> To: Ahmad Muhanna; Wassim Haddad
>> Cc: DE JUAN HUARTE FEDERICO; netlmm
>> Subject: RE: Text Proposal for Compromised MAG issue (was 
>> [netlmm]Reviewofdraft-ietf-netlmm-proxymip6-05)
>>
>> All,
>> The text proposed by Ahmad mostly looks fine to me, although it may be
>> worthwhile providing a hint for how one may do it in a non-AAA based
>> system.  How about the following (I've taken Ahmad's text and 
>> made some
>> minor changes/additions): 
>>
>> node is definitively attached to the   mobile access gateway that sent
>> the binding registration request.  This may be done by contacting a
>> trusted entity which tracks the MN current point of attachment, e.g. a
>> AAA server (as a result of an authentication exchange with the MN).
>> This may also be accomplished by verification of a live signature from
>> the MN, e.g., a CGA signature.  Details of how such 
>> verification of the
>> MN's point of attachment is done is outside the scope of this
>> specification." 
>>
>> Thanks,
>> Vidya
>>> -----Original Message-----
>>> From: Ahmad Muhanna [mailto:[email-masked]] 
>>> Sent: Friday, September 28, 2007 10:51 AM
>>> To: Wassim Haddad
>>> Cc: DE JUAN HUARTE FEDERICO; netlmm
>>> Subject: RE: Text Proposal for Compromised MAG issue (was 
>>> [netlmm] Reviewofdraft-ietf-netlmm-proxymip6-05)
>>>
>>> Hi Wassim,
>>>
>>> To be honest, the least to be said about all of this 
>>> compromised MAG discussion/issue is: May be not necessary and 
>>> probably a lot of time is wasted:-( I am sorry I 
>>> misunderstood what you were trying to say earlier, But yes, I 
>>> see it much clearer now.
>>>
>>> One more comment inline.
>>>
>>> Cheers:)
>>>
>>> Regards,
>>> Ahmad
>>>  
>>>
>>>> -----Original Message-----
>>>> From: Wassim Haddad [mailto:[email-masked]]
>>>> Sent: Friday, September 28, 2007 12:31 PM
>>>> To: Muhanna, Ahmad (RICH1:2H10)
>>>> Cc: DE JUAN HUARTE FEDERICO; Sri Gundavelli; netlmm
>>>> Subject: RE: Text Proposal for Compromised MAG issue (was 
>> [netlmm] 
>>>> Review ofdraft-ietf-netlmm-proxymip6-05)
>>>>
>>>> Hi Ahmad,
>>>>
>>>>> [Ahmad]
>>>>> So, can I read this that you think it is impossible and
>>>> does not make sense?
>>>>
>>>>>> then you can simply let the LMA updates the MAG (instead of the
>>>>>> opposite)
>>>> => Yes sure. But let summarize it again in few words:
>>>> the AAA can tell the LMA where the MN is following a successful 
>>> [Ahmad]
>>> Very interesting!
>>>>> [Ahmad]
>>>>> Just FYI:
>>>>> 1. A detailed solution for the so called compromised MAG is
>>>> out-of-scope.
>>>>

---

From: Julien Laganier <[email-masked]>
Date: Tue, 2 Oct 2007 11:13:25 +0200

> part and close this issue.

Generation of a *global* CGA requires the IPv6 subnet prefix assigned 
per PMIPv6 signalling.

OTOH, generation of a link-local CGA does not require completion of the 
PMIPv6 signalling since the prefix is well known in advance: fe80::/64.

I suggest we keep the CGA part.

--julien