Subject: Re: [MOBILE-IP] micromobility in IPv6 ?

From: Thomas Eklund <[email-masked]>
Date: Thu, 2 Mar 2000 16:02:01 +0100

Luca, I could not agree with you more...
Related work has been done in whats used to be called transport friendly
ipsec but I agree with you that we need a "mobile-optimized" mode of session
key generation/re-generation of IPsec...

/Thomas

> -----Original Message-----
> From: Luca Salgarelli [mailto:[email-masked]]
> Sent: Wednesday, March 01, 2000 8:06 PM
> To: [email-masked]
> Subject: Re: [MOBILE-IP] micromobility in IPv6 ?
>
>
> Hi Charley and Frank.
>
> I just wanted to add a few thoughts to your discussion, also
> in light of
> the ongoing discussion about cellular/wireless/fast-handoff
> support in MIP.
>
> As Frank said, every fast-handoff approach which has been
> proposed so far
> requires the use of a different security semantic than MIP a
> la rfc2002. In
> particular, it is necessary for those approaches not to mandate a
> verifiable HA-mobile authenticator in every message, in presence of a
> verified trust relationship between the mobile and the
> foreign domain that
> it is visiting.
>
> Now, I agree with Charlie's concerns about introducing an
> adjustment to
> rfc2002bis, where the adjustment, such as in this case, has
> not been proven
> to be interoperable.
>
> On the other hand, I think that leaving the door open for the
> different
> security semantic required by fast-handoff proposals is also
> an important
> issue.
>
> A proposal: would it be possible/enough to add yet another appendix to
> rfc2002bis, starting with, for example, the statement
> proposed by Frank?:
>
> > > >                      Perhaps it would be
> > > > better to add a statement like "The Mobile-Home Authentication
> > > > Extension is not needed if a security association is
> established between
> > > > the Mobile Node and the foreign network's
> infrastructure, and the
> > > > Registration Reply contains a valid Mobile-Foreign
> Authentication
> > > > Extension." This is already explicitly demanded by the
> HAWAII draft and
> > > > implemented, for example, in HUT Dynamics.
>
> Comments?
>
> Thanks
> Luca
>
>
> > Date:         Tue, 29 Feb 2000 09:22:19 +0100
> > Reply-To:     [email-masked]
> > Sender:       "IP Routing for Wireless/Mobile Hosts (mobile-ip)"
> >               <[email-masked]>
> > From:         Frank Paehlke
> <[email-masked]>
> > Organization: University of Karlsruhe
> > Subject:      Re: micromobility in IPv6 ?
> > X-To:         "Charles E. Perkins" <[email-masked]>
> > Content-Type: text/plain; charset=us-ascii
> >
> > Hello,
> >
> > "Charles E. Perkins" wrote:
> > >
> > > Hello Frank,
> > >
> > > I take your comment as relevant to the recently announced
> Last Call
> > > for RFC2002bis.  In that case, we should get some clarification so
> > > that I can figure out whether to change the current draft.
> >
> > many thanks for your interest, which I consider a big
> honour. Since the
> > mentioned comment was my first posting to this list, I was
> really a bit
> > afraid of being flamed.
> >
> > > > the problem, at least as far as I can tell, is the
> following sentence
> > > > which appears in RFC 2002 as well as in the latest RFC
> 2002bis draft
> > > > (section 3.6.2.1):
> > > >
> > > > "[...] if the Code field indicates that the
> registration was accepted
> > > > by the home agent, exactly one Mobile-Home
> Authentication Extension
> > > > MUST be present in the Registration Reply, and the
> mobile node MUST
> > > > check the  Authenticator value in the Extension."
> > >
> > > Yes, the idea being that a mobile node registers _only_ with its
> > > home agent.
> >
> > This is surely the most obvious approach as far as optimized local
> > handoff is not an issue. It also guarantees secure mutual
> authentication
> > of an MN and its home agent.
> >
> > > >                      Perhaps it would be
> > > > better to add a statement like "The Mobile-Home Authentication
> > > > Extension is not needed if a security association is
> established between
> > > > the Mobile Node and the foreign network's
> infrastructure, and the
> > > > Registration Reply contains a valid Mobile-Foreign
> Authentication
> > > > Extension." This is already explicitly demanded by the
> HAWAII draft and
> > > > implemented, for example, in HUT Dynamics.
> > >
> > > In the first place, any new protocol specification that advances
> > > to Proposed Standard can suggest modifications to RFC2002bis that
> > > have the effect of obsoleting part of the prior specification for
> > > any network device that adheres to the later specification.
> > >
> > > Even so, I would agree that minor adjustments to RFC2002bis are
> > > preferable to waiting for advancement of other specifications,
> > > whenever the adjustments are known to be interoperable
> and effective
> > > and so on.
> >
> > The idea behind my comment was to facilitate the development of
> > specifications which provide fast local handoffs (I am
> doing research in
> > this area, together with some colleagues, for my PhD
> thesis). As far as
> > I can see, such handoffs will have to be carried out
> without involving
> > the HA, which is difficult to achieve without breaking the
> standard in
> > its current form. All proposals for fast handoff (e.g.,
> HAWAII the HUT
> > Dynamics implementation) require the establishment of a security
> > association between the MN and the foreign network, which
> is then used
> > to authenticate the MN upon subsequent registrations
> without involving
> > the home agent.
> >
> > > I don't see that this change satisfies those criteria.  But, if
> > > others in the working group ask for the change, I would not mind
> > > putting something in.
> > >
> > > One major problem would be to have an unambiguous
> definition of the
> > > words "foreign network's infrastructure".  That's pretty vague, it
> > > seems to me.
> >
> > Probably the most common approach would be to establish a security
> > association between the MN and the foreign agent (e.g., as
> specified in
> > the AAA-regkey draft). When saying "foreign network's
> infrastructure", I
> > was thinking that perhaps there could also be a security association
> > with some other entity, e.g., a AAA server or the like. In
> HUT Dynamics,
> > for example, the security association is between the MN and *all*
> > foreign agents on the path towards the "highest FA".
> >
> > But as long as these thoughts are relatively vague, I now
> agree with you
> > that it would probably be better to explicitly demand a security
> > association between the MN and a foreign agent (old, new, or first
> > common parent of old and new). I deliberately chose the wording "a
> > statement like..." because I was not 100% sure (and because
> I am not a
> > native speaker of English :-)
> >
> > Regards,
> > Frank Paehlke
> > --
> > Frank Paehlke
> > Institut fuer Telematik       Phone: +49 721 608-6398
> > Universitaet Karlsruhe (TH)   Fax:   +49 721 388097
> > D-76128 Karlsruhe, Germany EMail: [email-masked]
>