Subject: [Pana] I-D ACTION:draft-hiko-pana-fpana-00.txt

From: [email-masked]
Date: Fri, 15 Jul 2005 20:58:02 +0900

I would add some explanations about the security of transferring Keys.
 
>>The second comments is that you directly transfer AAA-Key/AAA-Key-name
>>and PANA_MAC_Key from the pAR to the nAR which is not good from a
>>security perspective.
>
>We assumed that IPsec SA has been already established between ARs. So we
>thought
>it has no problem to transfer the PANA_MAC_KEY directly.
>If transferring the PANA_MAC_Key is not good, key materials like the
>AAA-Key-int
>may be transferred instead of the PANA_MAC_KEY.
 
We transfer "session lifetime" (equal to the life time of the PANA_MAC_KEY)
from PAR to NAR.  If the same PANA_MAC_Key is used with a renewal 
lifetime on NAR, it can't be avoided the domino effect. 
But FPANA carry over the lifetime from PAR to NAR, 
so that the level of  risk is same as the condition that an MN dosen't move.
 
Regards,
------------------------------
Natsuko Ono
BB Mobile Corp.  / Japan Telecom Co., Ltd.
E-mail:[email-masked]
------------------------------
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Yoshihiko Kainuma
Sent: Friday, July 15, 2005 6:06 PM
To: Julien Bournelle
Cc: [email-masked]
Subject: Re: [Pana] I-D ACTION:draft-hiko-pana-fpana-00.txt

Thanks for your comment.

The goal of our draft is realization of seamless handover and AAA. So we 
select
FMIPv6 as the method of seamless handover. Our proposal is the method of 
PANA
optimization for FMIPv6.

 >The second comments is that you directly transfer AAA-Key/AAA-Key-name
 >and PANA_MAC_Key from the pAR to the nAR which is not good from a
 >security perspective.

We assumed that IPsec SA has been already established between ARs. So we 
thought
it has no problem to transfer the PANA_MAC_KEY directly.
If transferring the PANA_MAC_Key is not good, key materials like the 
AAA-Key-int
may be transferred instead of the PANA_MAC_KEY.

 >I think that requiring that PAA/AR and EP to be colocated is a strong
 >requirement since we are now considering pana-multihop in the charter.

We think it may be possible to optimization multi-hop PANA for FMIPv6. 
Following
illustration is example of optimization. "New Message1" is advertisement 
of MN's handover.
nEP can learn MN's IP address and MAC address by HI message. Then nEP can
advertise which node is going to move. We will study about multi-hop 
PANA more.

    MN                      PAR(pEP)               NAR(nEP) 
                   PAA
      |                                |                                
|                                |
      |--------FBU------->|                                
|                                |
      |                                
|---------HI-------->|                                |
      |                                |                                
|--New Message1-->|
      |                                |                                
|                                |
      |                                |                                
|<-New Message2---|
      |                                
|<------Hack--------|                                |
      |<------FBack-------|                                
|                                |
      |                                |                                
|                                |

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana