Subject: Re: [netlmm] DISCUSS and COMMENT: draft-ietf-netlmm-proxymip6 (fwd)

From: Sri Gundavelli <[email-masked]>
Date: Sun, 13 Apr 2008 23:28:49 -0700 (PDT)

FYI.

This resolves all issues from Tim Polk's review.

Sri

---------- Forwarded message ----------
Date: Sat, 12 Apr 2008 18:51:30 -0700 (PDT)
From: Sri Gundavelli <[email-masked]>
To: Tim Polk <[email-masked]>
Subject: Re: DISCUSS and COMMENT: draft-ietf-netlmm-proxymip6

Hi Tim,

Thanks for your time on this.

Regards
Sri

On Thu, 10 Apr 2008, Tim Polk wrote:

>  Sri,
>
>  Since Mobile IPv6 doesn't mandate IKEv1 or v2, it makes sense
>  to be consistent here.
>
>  Good enough.
>
>  Thanks,
>
>  Tim Polk
>
>  On Apr 6, 2008, at 1:27 AM, Sri Gundavelli wrote:
> 
> >   Hi Tim,
> > 
> >   Wondering, if you have any further comments on this
> >   and if you are satisfied with our response on
> >   not mandating IKEv2.
> > 
> >   Regards
> >   Sri
> > 
> > >   -----Original Message-----
> > >   From: Sri Gundavelli [mailto:[email-masked]]
> > >   Sent: Thursday, March 27, 2008 9:07 PM
> > >   To: 'Tim Polk'; [email-masked]'
> > >   Cc: [email-masked]';
> > >   [email-masked]'
> > >   Subject: RE: DISCUSS and COMMENT: draft-ietf-netlmm-proxymip6
> > > 
> > >   Hi Tim,
> > > 
> > >   Thanks for the review. Please see inline ..
> > > 
> > >   Sri
> > > 
> > > 
> > > 
> > > >   -----Original Message-----
> > > >   From: Tim Polk [mailto:[email-masked]]
> > > >   Sent: Wednesday, March 26, 2008 8:34 AM
> > > >   To: [email-masked]
> > > >   Cc: [email-masked];
> > > >   [email-masked]
> > > >   Subject: DISCUSS and COMMENT: draft-ietf-netlmm-proxymip6
> > > > 
> > > >   Discuss:
> > > >   Section 4, Proxy Mobile IPv6 Security, provides some
> > > >   guidelines for the application of
> > > >   IPsec, but lacks the specificity in several aspects to ensure
> > > >   interoperability. Specifically:
> > > > 
> > > >   (1) Section 4 specifies that IKEv2 SHOULD be used to setup
> > > >   security associations between
> > > >   the MAG and LMA, but to my reading IKEv2 is not mandatory to
> > > >   implement.
> > > 
> > >   Yes. We require IPsec as mandatory to implement. For
> > >   key management we recommend the use of IKEv2, however we do
> > >   not mandate on implementation or on use.
> > > 
> > > 
> > > >   (2) Section 4 permits the MAG and LMA to use any of the
> > > >   authentication options
> > > >   specified in IKEv2 for authentication, which is reinforced in
> > > >   section 4.1 which notes
> > > >   that the peer authentication mechanisms in the PAD examples
> > > >   (shared secrets,
> > > >   certificates, or EAP) are not exhaustive.  No authentication
> > > >   mechanism is mandatory
> > > >   to implement.
> > > > 
> > > >   Did the wg consider specifying IKEv2 as mandatory to
> > > >   implement?  What about
> > > >   specifying a mandatory to implement authentication mechanism?
> > > >   If this was
> > > >   considered and rejected, I would like to understand why
> > > >   mandatory to implement
> > > >   mechanisms are not required/desirable.
> > > > 
> > > 
> > >   This protocol for network-based mobility is based on Mobile
> > >   IPv6 protocol and all signaling and security semantics are
> > >   based of that protocol. Mobile IPv6 does not mandate on the
> > >   use of IKEv1 or IKEv2 for key management and the same security
> > >   model is applied here.
> > > 
> > >   Also, given the applicability scope of this protocol, we may
> > >   not be able to mandate the use or implementation of IKEv2. The
> > >   SDO architectures where this protocol will be applied will
> > >   generally have their own key management functions. However,
> > >   IKEv2 is recommended for key management.
> > > 
> > > 
> > > 
> > > >   Comment:
> > > >   The security considerations provide a nice description of how
> > > >   the Proxy Mobile IPv6 protocol
> > > >   defends itself against most of the threats listed in RFC
> > > >   4382, but does not address threats
> > > >   from the Internet (Section 4 of RFC 4382).  For completeness,
> > > >   please note how the Proxy Mobile
> > > >   IPv6 protocol does (or does not) defend against these threats.
> > > > 
> > > 
> > >   We probably did not add text related to this threat, as it is
> > >   a very common threat and the impact is just the same for Proxy
> > >   Mobile IPv6 entities as in for a fixed network. Also, I think
> > >   I did have some text on this earlier and based on some review
> > >   feedback, I took it out as the threat is not really standing
> > >   out and the text in 4832 pretty much states that.
> > > 
> > >   A DOS attack by flooding packets to a prefix assigned to a mobile
> > >   node, will result in the LMA and the serving MAG ending up
> > >   processing those packets, just as any on-path router processing
> > >   those packets. This protocol does not defend itself against such
> > >   attacks and this vulnerability is not unique to Proxy Mobile IPv6
> > >   protocol.
> > > 
> > >   A DOS attack on the LMA or MAG is again a very common attack on
> > >   like any other network services and is not unique to Proxy Mobile
> > >   IPv6 protocol entities. This protocol does not defend itself
> > >   against such attacks.
> > > 
> > >   Thanks for the review.
> > > 
> > >   Regards
> > >   Sri
> > > 
> > > 
> > > 
> > > 
> > > 
> > > 
> > 
> 
> 
>
_______________________________________________
netlmm mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/netlmm