Subject: Re: [MOBILE-IP] [Fwd: Re: [MOBILE-IP] New version of "MobilitySup port inIPv6"draft]

From: Glenn Morrow <[email-masked]>
Date: Mon, 23 Oct 2000 10:46:47 -0500

Hi Charlie,

See below:

> > [[gm]]  consider this:
> >
> >         IPv6 header, HA dest hder, AH, BU dest hdr, SIP Invite
> >
> > How does one know whether the authenitication parameters related to the
> > binding update are the same as the parameters related to the SIP Invite
> or for
> > that matter - any application?
>
> AH is for _network layer_ binding.
>
> It does not give any assurance that application is authorized
> to offer the services or interactions peculiar to that application.
> If there is a way for an application to get installed on a host
> that it should not be running on, then that application _can_
> "subvert" the network-layer security infrastructure.
>
> Does this answer your question?
[[gm]]
What I thinking was that users may have more than one identity and therefore
credentials for authorization. One set of credentials may relate to service
for an application and the other relate to credentials for network layer
access which I believe node mobility should be an integral part of.

> > Are we making some assumptions here about business models that perhaps
> we
> > shouldn't?
>
> The distance between business models and network-layer security
> is farther than I can usefully comprehend.
[[gm]]
The point is simple. I don't think we want to couple ownership and control
of applications to the network access ownership in the IETF.

> > Is it possible to have more than one AH header with different checksum
> > boundaries?
>
> Not as far as I know.
[[gm]]
I think we might need something like this if we plan on sending application
packets that need to be authorized using the credentials from one identity
in the same packet as a binding update that might need authorization using
the credentials from another identity.

A simple IF statement might work. i.e. if the application part needs
authorization using a separate identity then we have to send separate
packets?

> Regards,
> Charlie P.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 23 Oct 2000 09:24:13 -0700

Hello Glenn,

What I think you want can _possibly_ be done using AH,
if the operating system is sufficiently secure, and
the other communication endpoint sufficiently restriced
in the services it is configured to offer.

But it's definitely NOT an issue for Mobile IP, so I
reckon we ought to take it offline.  I am pretty sure
that you can find megabytes of good technical discussion
on this issue if you look at the IPsec mailing list
archives.

Regards,
Charlie P.

> Glenn Morrow wrote:
> > binding update are the same as the parameters related to the SIP Invite or
> for
> > Are we making some assumptions here about business models that perhaps we
> > shouldn't?
>
> The point is simple. I don't think we want to couple ownership and control of
> applications to the network access ownership in the IETF.
>
> packets that need to be authorized using the credentials from one identity in
> the same packet as a binding update that might need authorization using the
> credentials from another identity.
>
> authorization using a separate identity then we have to send separate packets?
>
> Regards,
> Charlie P.

---

From: Francis Dupont <[email-masked]>
Date: Sun, 29 Oct 2000 14:26:12 +0100

I agree, IPsec doesn't provide user authentication (ie. IPsec is not radius)
or application level authentication (ie. IPsec is not PGP). IPsec provides
only device strong authentication which is required by mobility...

Regards

[email-masked]