Subject: RE: WG next steps

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Fri, 15 Nov 2002 01:12:30 +0100

> This is intuitively correct, but I have a hunch that 
  > pushing the intellegence
  > into the end points raises a whole bunch of security 
  > problems.  Traditionally
  > we believe routers have been secure (this may not be case 
  > in reality), and this
  > has been the motivation to find a solution that does not 
  > entail end point
  > intelligence to solve the MH problem.

=> I don't think pushing the intelligence to the 
end points will introduce additional security threats
to those introduced by allowing routers to do the job. 
The problem is the same: change address from A to B.
Solving it using routers or end hosts will not change the
problem (ok PI is a different case). 

The obvious reason for doing it in end hosts is scalability. 
Another advantage with using the end host is that the
security issues are well understood, for example if 
MIPv6 is used, we will have a pretty good idea of the 
level of security required to do the job.

Hesham

---

From: Peter Tattam <[email-masked]>
Date: Fri, 15 Nov 2002 11:21:39 +1100 (EST)

> level of security required to do the job.

I will repeat what I said before that I think that any solution that involves
crypto of any kind needs to be carefully thought through from the point of view
of CPU resources on end hosts.  While the traditional mobile host end points
probably don't care too much, for a general solution that would involve large
servers with thousands of connections, the MH solution must be low cost in such
an environment.

The edge router solution is not a complete solution either as has been alluded
to.  There will be instances where an end host may be connected to two paths,
neither knowing much about each other (e.g. cable, dsl and modem in a home
network).

Sounds to me like the only solution that will fly will be an E2E solution.

> Hesham

Peter

--
Peter R. Tattam                            [email-masked]
Managing Director,    Trumpet Software International Pty Ltd
Hobart, Australia,  Ph. +61-3-6245-0220,  Fax +61-3-62450210

---

From: Masataka Ohta <[email-masked]>
Date: Fri, 15 Nov 2002 10:13:05 +0859 ()

Peter;

> >   > intelligence to solve the MH problem.

I have never seen any router based solution claiming better security
than host based ones.

Are there really any?

> servers with thousands of connections, the MH solution must be low cost in such

Combination of cookies, a hash function and reverse/forward DNS
is just fine to make mobile and multihomed hosts weakly secure.

							Masataka Ohta