Subject: [Autoconf] Re: Autoconf Digest, Vol 23, Issue 20

From: "Hasnaa Moustafa" <[email-masked]>
Date: Wed, 12 Dec 2007 14:29:43 +0100

Hi Teco,

Thanks for your reply.

Please so my comments below.

Regards,
Hassnaa

Date: Wed, 12 Dec 2007 09:53:21 +0100
> From: "Teco Boot" <[email-masked]>
> Subject: RE: [Autoconf] Supporting commercial ISPs
> To: "'Hasnaa Moustafa'" <[email-masked]>
> Cc: [email-masked]
> Message-ID: <000701c83c9c$73b2edd0$5b18c970$@nl>
> Content-Type: text/plain; charset="us-ascii"
>
> Hi Hassnaa,
>
>
>
> Comments inline.
>
>
>
> Van: Hasnaa Moustafa [mailto:[email-masked]]
> Verzonden: dinsdag 11 december 2007 16:38
> Aan: [email-masked]
> CC: [email-masked]
> Onderwerp: Re: [Autoconf] Supporting commercial ISPs
>
>
>
> Hi Teco,
>
>
>
> Thanks for you reply.
>
>
>
> There are a number of points that are not so clear for me.
>
>
>
> Please see below.
>
>
>
> Hassnaa
>
>
>
> On 12/10/07, Teco Boot <[email-masked]> wrote:
>
> Hi Hasnaa,
>
> Thanks for the clear response.
> I think we should include some scenarios on extending service coverage
> area
> of an ISP access network in the PS document. Suggested scenarios:
>
>
>
>
>
> Hassnaa: I am not so sure if we need a special scenario for this, as this
> type of scenario is a connected one. Then the description of the connected
> scenario in the PS could include such a case (MANET connected to an ISP
> access network).
>
>
>
>
> 1)
> Full trust between Access Routers and MANET Routers. MANET Links and
> Access
> Links are protected using L2 security. Border Routers and Access Routers
> can
>
> be integrated, i.e. Access Routers may run MANET routing protocol. Access
> Routers may provide prefixes and addresses.
>
>
>
> Hassnaa:
>
> How do you differentiate between MANET links and Access links?
>
> -If Access Routers and Border Routers are integrated in one entity (as you
> mentioned), then there is no difference, IMO, between Access links and
> MANET
> links.
>
> [Teco:]
>
> In this case, there is no access link.

Hassnaa: I agree, in this case, all links can be considered as MANET links.

- When talking about L2 Security (for instance 802.1x model), I could not
> see how it could take place in a multi-hop MANET environment. So far, the
> existing standard mechanisms function in a WLAN environment (protecting
> the
> link between a mobile node and an Access point). So saying MANET links are
> protected using L2 security --> implies the existence of a mechanism that
> assures L2 security within the multi-hop environment (which does not
> conform
> with the reality).
>
> [Teco:]
>
> I am not sure 802.1x cannot be used for MANET links. 802.11i-2004describes
> how this should work for IBSS.

Hassnaa: 802.11i is mainly for WLAN, and they define as an option the
authentication using PSK for the ad hoc mode. But this concerns the
peer-to-peer ad hoc communication and does not concern the multi-hop
communication. Besides, the PSK proved to be a weak authentication method.

I prefer using pre-shared keys in MANET.

Hassnaa: As I mentioned above, PSK proved to be a weak authentication method
(same weakness of the WEP security solutions) and also has its management
burden.

Many existing MANET products use local configured settings, for security and
> other. Manual provisioning of MANET Local Addresses is natural in such
> cases. This is why I asked what the added value of Autoconf is.

Hassnaa: Manual provisioning is only practical for small networks
configuration and closed environments, which is not the general case. Also,
with nodes' mobility (partitioning and merging issues, ...), there would be
a hard need for dynamic (automatic) address configuration for easier IP
address assignment management.

The question here is, what is the added value of Autoconf? IMHO all nodes
> are provisioned before deployment; e.g. security parameters and key
> material. Configuring addresses is not that much extra.
>
>
>
> Hassnaa:
>
> I did not get, what do you mean by "added value of Autoconf" --> for me
> the
> added value of autoconf is the "IP address provision for manet routers"
> (Maybe I miss something!).
>
> [Teco:]
>
> Yes, but when keys (and other settings) need to be configured before
> deployment, why not configuring MLA also?
>
> For global addresses, Autoconf functionality can be useful.

Hassnaa: please see my previuos comment.

2)
> No trust between Access Routers and MANET routers. Border routers use
> protected L2 links to Access Routers. Border Routers are fixed or mobile.
> Access Routers do typically not provide prefixes, they only provide
> addresses to attached nodes.
>
>
>
> Hassnaa:
>
> If there is no trust between the Access Routers and the MANET routers,
> then
> this does not conform with a MANET connected to an ISP access network. For
> commercial deployment of MANETs, each manet router is considered as a
> "mobile client", and this "mobile client" could not be connected to the
> ISP
> access network if he is not legitimate (implying "trust relationship" with
> the Access Routers directly or indirectly. Directly, if the mobile client
> is
> a subscriber with the ISP that owns the Access routers, while indirectly
> if
> the mobile client is a subscriber with another ISP that has a trust
> relationship with the current ISP.
>
> [Teco:]
>
> In both the  "directly" and "indirectly" case, each MANET Router that can
> access the ISP network is also Border Router, OK?

Hassnaa: If this MANET Router has a direct link with the Access Router, then
I agree that it is a Border Router. Do you mean this?

In this case, assistance from NEMO functionally and HA could be used for
> providing prefixes to Border Routers. MANET routing protocol may run on
> MRHA
>
> tunnel.
> The question here is, what is the trust relation between the MANET
> Routers?
> And also what is the added value of Autoconf in case of configured
> security
> parameters and key material?
>
>
>
> Hassnaa: Same previous comment for the "added value of Autoconf"!
>
> [Teco:]
>
> I am just asking myself this question on added value of Autoconf.
>
> If access to ISP network is managed on Access Router - Border Router link,
> current global address assignment protocols are used and Autoconf is not
> needed.

Hassnaa: I did not get what you mean by "current global address assignment
protocol"!
IMO, Autoconf is required (even in the presence of ISP) for providing unique
IP addresses among the multi-hop nodes and also for managing IP addresses in
case of nodes' leave.

If there is no preconfigured trust relation between the MANET Routers, but
> MANET Routers want to communicate with each other, MLA is needed. Here
> Autoconf functionality can be useful.

Hassnaa: IMO, the two issues (IP autoconf) and (Trust) should Co-exist in
the case of a MANET connected to an ISP access network.

3)
> New security mechanism for setting up trust relation between Access
> Routers
> and MANET Routers. In this case, each MANET Router sets up a secured link
> to
>
> one or more Access Routers. I think network operators require some kind of
> hardware authentication (e.g. SIM), or maybe some form of certificates
> could
> be used. NEMO can be used in this case also.
>
>
>
> Hassnaa: I think that this point goes into details concerning the security
> issue (which is not sure to be in the scope of the WG).
>
> [Teco:]
>
> Partly agreed. I think we should not work on security solutions, but I
> think
> it is important to know what the requirements for real world deployment
> are.
> If we do not cope with it, the newly defined protocols are dead already. I
> think it is better to circumvent this.

Hassnaa: I totally agree that some requirements (related to real world
deployment) should be highlighted.

One of the ideas in Autoconf is, is providing a facility for multihop MANET
> communication between a MANET Router and the Internet. Our goal is to
> provide a Problem Statement document. If there is a security problem with
> this topology, I do not see a reason why we should not describe this.
> Solving the problem is another thing, it requires rechartering Autoconf or
> something else.
>
>
>
>
>
> I did not use "new terminology" Internet Configuration Provider, as I do
> not
> know what this is.
> I used Access Router instead of ISP Edge Router, as this is a well known
> name for this entity (RFC3753).
>
> What do you think?
>
>
>
> Hassnaa: IMHO, it is interesting to include the case of "a MANET
> connectected to an ISP access network" in the "Connected MANET subsection
> in
> the PS" --> I could eventually provide some text if there is an agreement
> on
> this point.
>
> [Teco:]
>
> This would be great!

Hassnaa: Then, we need a general agreement on this.

Teco.
>
>
>
> If there is also an agreement on including a requirement section in the PS
> document "the point that was discussed in Vancouver, but not yet
> concluded"
> --> it would be then important to consider some requirements related to
> this
> case (this would be security requirements, as well as operational
> requirements).
>
>
>
>
>
> Comments and feedbacks are more than welcome.
>
>
>
>
>
>
>
> Any comment from others, familiar with ISP / network operator
> requirements?
>
> Teco.
>
>
> ----------------------------------------------------------------------------
>
> ------------------------
> Van: Hasnaa Moustafa [mailto:[email-masked]]
> Verzonden: vrijdag 7 december 2007 20:11
> Aan: [email-masked]  <mailto:[email-masked]>
> CC: [email-masked]
> Onderwerp: Re: Autoconf Digest, Vol 23, Issue 18
>
> Hi Teco,
>
> Thanks for raising this interesting issue.
>
> Considering Commercial ISPs is the way for wide scale MANET deployments. I
> believe that IP autoconfiguration is one of the tough issues blocking the
> real MANET deployment by ISPs.
>
> Even if we think ofL2 security (existing in WLAN hotspots deployed by
> ISPs),it is not feasible to apply it in a MANET multi-hop environment, and
> no standard solution existing nowproviding L2 security in multi-hop MANET
> environment.
>
> I agree with your point that ISP should provide IP autoconfiguration for
> their clients or even other legitimate clients (belonging to other ISPs,
> for
>
> instance, if there is a trust relationship between different ISPs). And
> there is a number of requirements that can exist in this case.
> But the mainquestion (before talking about this issue) concerns the
> autoconf WG scope: is the WG looking forIP autoconf solutions
> concerningsuch type of scenario --> (MANETs that extends the service
> coverage of an ISPaccess network? And of coarse: this is a connected
> MANET.)
>
> IMHO, this is an important scenario highlighting a concrete MANET
> application and having special requirements.
>
> Hassnaa
>
> ----------------------------------------------------------------------------
> ------------------------
> Date: Thu, 6 Dec 2007 21:02:39 +0100
> From: "Teco Boot" < [email-masked]>
> Subject: [Autoconf] Supporting commercial ISPs
> To: < [email-masked]>
> Message-ID: <013a01c83843$07d54200$177fc600$@nl >
> Content-Type: text/plain; charset="us-ascii"
>
> I have a somewhat fundamental question on AUTOCONF requirements; do we
> consider commercial ISPs?
>
> I think in real world, we have two environments: private networks and
> Internet.
>
> Private networks could use L2 security and within the network there is no
> hard requirement for access control. However, even in these private
> networks
>
> access control is getting important.
>
> For Internet, ISP provide access to their customers. And probably to their
> customers only. I wonder how we can support this kind of operation.
>
> I appreciate any comment from ISPs, on what they want to be supported. I
> think the outcome has a large impact on the requirements.
>
> Teco.
>
> ------------------------------
>
> _______________________________________________
> Autoconf mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/autoconf
>
>
> End of Autoconf Digest, Vol 23, Issue 18
> ****************************************
>
>
>
>
>
>
> -------------- next part --------------
> An HTML attachment was scrubbed...
> URL:
> http://www1.ietf.org/pipermail/autoconf/attachments/20071212/08abec50/attachment.html
>
> ------------------------------
>
> _______________________________________________
> Autoconf mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/autoconf
>
>
> End of Autoconf Digest, Vol 23, Issue 20
> ****************************************
>
_______________________________________________
Autoconf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/autoconf

---

From: "Teco Boot" <[email-masked]>
Date: Wed, 12 Dec 2007 15:08:47 +0100

Hi,

Once againJ, comments inline.

I think this mail gets hard to read. I suggest we close this mail-discussion
and take the next step on what to add in PS document. I think we have enough
input now.

Teco.

Van: Hasnaa Moustafa [mailto:[email-masked]] 
Verzonden: woensdag 12 december 2007 14:30
Aan: [email-masked]
CC: [email-masked]
Onderwerp: Re: Autoconf Digest, Vol 23, Issue 20

Hi Teco, 

Thanks for your reply.

Regards,

Hassnaa

From: "Teco Boot" < <mailto:[email-masked]>  [email-masked]>

Hi Hassnaa,

Comments inline.

Van: Hasnaa Moustafa [mailto: [email-masked]]
Verzonden: dinsdag 11 december 2007 16:38
Aan: [email-masked]
CC: [email-masked]
Onderwerp: Re: [Autoconf] Supporting commercial ISPs

Hi Teco,

Thanks for you reply.

Please see below.

Hassnaa

Hi Hasnaa,

Thanks for the clear response.
I think we should include some scenarios on extending service coverage area 
of an ISP access network in the PS document. Suggested scenarios:

1)
Full trust between Access Routers and MANET Routers. MANET Links and Access
Links are protected using L2 security. Border Routers and Access Routers can

Hassnaa:

-If Access Routers and Border Routers are integrated in one entity (as you
mentioned), then there is no difference, IMO, between Access links and MANET
links.

[Teco:]

 

- When talking about L2 Security (for instance 802.1x model), I could not
see how it could take place in a multi-hop MANET environment. So far, the 
existing standard mechanisms function in a WLAN environment (protecting the
link between a mobile node and an Access point). So saying MANET links are
protected using L2 security --> implies the existence of a mechanism that 
assures L2 security within the multi-hop environment (which does not conform
with the reality).

[Teco:]

I am not sure 802.1x cannot be used for MANET links. 802.11i-2004 describes
how this should work for IBSS. 

[Teco:] 

We can have long discussions on PSK. 

In my environment, key management other than PSK is not accepted. 

I suggest not to discuss this, as it is totally out-of-scope of Autoconf and
our opinions on it does not help us at all.

 

[Teco:] 

Oeps. WEP is based on RC4. That is the prime cause of the weakness. I am not
aware of a WPA2-PSK weakness, and maybe there are better algorithms (for
sure more secret).

We are still discussing case 1, where the pre-assumption is that all nodes
have trusted links. Maybe this is not applicable in commercial environments,
but in military and probably in public safety I think this is the current
and preferred setup. Things can change here, but don't expect anything soon.

Hassnaa: Manual provisioning is only practical for small networks
configuration and closed environments, which is not the general case. 

[Teco:] 

Agreed, but environments can be quite large.

Also, with nodes' mobility (partitioning and merging issues, ...), there
would be a hard need for dynamic (automatic) address configuration for
easier IP address assignment management. 

[Teco:] 

For MLA, I doubt.

For Global Addresses, I agree. I expect that only IPsec traffic between
MANET Router and Corresponding Nodes is required and that all other traffic
must be blocked. So MANET Router acts as host in this case.

Hassnaa:

I did not get, what do you mean by "added value of Autoconf" --> for me the
added value of autoconf is the "IP address provision for manet routers" 
(Maybe I miss something!).

[Teco:]

 

 

2)

Hassnaa:

If there is no trust between the Access Routers and the MANET routers, then
this does not conform with a MANET connected to an ISP access network. For 
commercial deployment of MANETs, each manet router is considered as a
"mobile client", and this "mobile client" could not be connected to the ISP
access network if he is not legitimate (implying "trust relationship" with 
the Access Routers directly or indirectly. Directly, if the mobile client is
a subscriber with the ISP that owns the Access routers, while indirectly if
the mobile client is a subscriber with another ISP that has a trust 
relationship with the current ISP.

[Teco:]

 

[Teco:] Yes

In this case, assistance from NEMO functionally and HA could be used for
providing prefixes to Border Routers. MANET routing protocol may run on MRHA

tunnel.
The question here is, what is the trust relation between the MANET Routers?
And also what is the added value of Autoconf in case of configured security
parameters and key material?

[Teco:]

[Teco:] 

I think that on the Access Router - Border Router link, address assignment
is already available. So when a direct or indirect link between MANET Router
and Border Router exists, this should work.

Maybe there is somewhat confusion on direct links - indirect links. I think
we came up in both cases the MANET Router is Border Router, and that in the
indirect case there is "roaming agreement" between the serving ISP (Access
Router) and the ISP where the user of the MANET Router / Border Router is
subscribed.

3)
New security mechanism for setting up trust relation between Access Routers
and MANET Routers. In this case, each MANET Router sets up a secured link to

one or more Access Routers. I think network operators require some kind of
hardware authentication (e.g. SIM), or maybe some form of certificates could
be used. NEMO can be used in this case also.

[Teco:]

Partly agreed. I think we should not work on security solutions, but I think

it is important to know what the requirements for real world deployment are.
If we do not cope with it, the newly defined protocols are dead already. I
think it is better to circumvent this.

 

I did not use "new terminology" Internet Configuration Provider, as I do not
know what this is.
I used Access Router instead of ISP Edge Router, as this is a well known 
name for this entity (RFC3753).

What do you think?

Hassnaa: IMHO, it is interesting to include the case of "a MANET
connectected to an ISP access network" in the "Connected MANET subsection in

the PS" --> I could eventually provide some text if there is an agreement on
this point.

[Teco:]

This would be great!

 

Teco.

If there is also an agreement on including a requirement section in the PS
document "the point that was discussed in Vancouver, but not yet concluded" 
--> it would be then important to consider some requirements related to this
case (this would be security requirements, as well as operational
requirements).

Any comment from others, familiar with ISP / network operator requirements?

Teco.

------------------------ 
Van: Hasnaa Moustafa [mailto:[email-masked]]
Verzonden: vrijdag 7 december 2007 20:11
Aan: [email-masked]  <mailto: [email-masked]>
CC: [email-masked]
Onderwerp: Re: Autoconf Digest, Vol 23, Issue 18

Hi Teco,

I agree with your point that ISP should provide IP autoconfiguration for 
their clients or even other legitimate clients (belonging to other ISPs, for

Hassnaa

------------------------

Private networks could use L2 security and within the network there is no
hard requirement for access control. However, even in these private networks

Teco.

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
http://www1.ietf.org/pipermail/autoconf/attachments/20071212/08abec50/attach
ment.html

---

From: "Hasnaa Moustafa" <[email-masked]>
Date: Fri, 14 Dec 2007 08:58:56 +0100

Hi,
I agree on closing this mail and concluding all these discussions with some
concrete points.
Then, I could provide some text concerning this issue (case of the MANET
connected to the ISP access network) and also some requirements (addition on
the list that Carlos sent before) related to this case. I could send these
to the list for discussion and for checking the possibility of consideration
in the PS.

I just need an agreement on this (especially from the PS authors), does this
sound good?

Hassnaa

On 12/12/07, Teco Boot <[email-masked]> wrote:
> I think this mail gets hard to read. I suggest we close this
> mail-discussion and take the next step on what to add in PS document. I
> think we have enough input now.
>
>
>
> Teco.
>
>
>
> *Van:* Hasnaa Moustafa [mailto:[email-masked]]
> *Verzonden:* woensdag 12 december 2007 14:30
> *Aan:* [email-masked]
> *CC:* [email-masked]
> *Onderwerp:* Re: Autoconf Digest, Vol 23, Issue 20
>
>
>
> Hi Teco,
>
>
>
> Thanks for your reply.
>
>
>
> *[Teco:] *
> *We can have long discussions on PSK. *
>
> *In my environment, key management other than PSK is not accepted. *
>
> *I suggest not to discuss this, as it is totally out-of-scope of Autoconf
> and our opinions on it does not help us at all.*
>
>
>
>
>
> Hassnaa: As I mentioned above, PSK proved to be a weak authentication
> method (same weakness of the WEP security solutions) and also has its
> management burden.
>
> *[Teco:] *
>
> *Oeps. WEP is based on RC4. That is the prime cause of the weakness. I am
> not aware of a WPA2-PSK weakness, and maybe there are better algorithms (for
> sure more secret).*
>
> *We are still discussing case 1, where the pre-assumption is that all
> nodes have trusted links. Maybe this is not applicable in commercial
> environments, but in military and probably in public safety I think this is
> the current and preferred setup. Things can change here, but don't expect
> anything soon.*
>
> * *
>
>
>
>
>
> *[Teco:] *
> *Agreed, but environments can be quite large.*
>
> * *
>
> *[Teco:] *
> *For MLA, I doubt.*
> *For Global Addresses, I agree. I expect that only IPsec traffic between
> must be blocked. So MANET Router acts as host in this case.*
>
>
>
>
>
> Hassnaa: If this MANET Router has a direct link with the Access Router,
> then I agree that it is a Border Router. Do you mean this?
>
> *[Teco:] Yes*
>
>
>
>
>
> IMO, Autoconf is required (even in the presence of ISP) for providing
> unique IP addresses among the multi-hop nodes and also for managing IP
> addresses in case of nodes' leave.
>
> *[Teco:] *
>
> *I think that on the Access Router – Border Router link, address
> assignment is already available. So when a direct or indirect link between
> MANET Router and Border Router exists, this should work.*
>
> *Maybe there is somewhat confusion on direct links – indirect links. I
> think we came up in both cases the MANET Router is Border Router, and that
> in the indirect case there is "roaming agreement" between the serving ISP
> (Access Router) and the ISP where the user of the MANET Router / Border
> Router is subscribed.*
>
>
>
>
>
> URL: http://www1.ietf.org/pipermail/autoconf/attachments/20071212/08abec50/attachment.html
>
>