Subject: Re: [MOBILE-IP] authorization to issue a Binding Update for a Home Address

From: Mohan Parthasarathy <[email-masked]>
Date: Thu, 21 Dec 2000 11:49:17 -0800

>    Also, if you use FQDN you need a way to bind the FQDN securely
>    to an IP address of some sort (could be the home address).
>
> => this is again the authorization problem. I don't understand why
> this is so hard for mobile IPv6 when the problem exists for VPN too
> (a security gateway will give a subnet identity in phase two, this
> should be accepted only if the peer is authorized to be a security
> gateway for this subnet. The text in RFC 2409 is (near) clear about this:
>
>    The identities of the SAs negotiated in Quick Mode are implicitly
>    assumed to be the IP addresses of the ISAKMP peers, without any
>    implied constraints on the protocol or port numbers allowed, unless
>    client identifiers are specified in Quick Mode.  If ISAKMP is acting
>    as a client negotiator on behalf of another party, the identities of
>    the parties MUST be passed as IDci and then IDcr.  Local policy will
>    dictate whether the proposals are acceptable for the identities
>    specified.  If the client identities are not acceptable to the Quick
>    Mode responder (due to policy or other reasons), a Notify payload
>    with Notify Message Type INVALID-ID-INFORMATION (18) SHOULD be sent.
>
> Then if the IDci or IDcr are not the address identities of the peers
> then local policy must authorize or not authorize them.)
> I can't see a real difference between mobility (different address) and
> VPNs (subnet), both need authorization. BTW I'd like to know how
> this is implemented in current IKEs (ask IPsec people?)
>
There is no difference. But unless there is a rich policy semantics
which says "Accept Phase II identity as X for phase I identity as Y",
it is difficult to do the binding. Moreover, how does the CN get
this policy information ?

>    >    2) Phase II SA should use client identifiers to specify the HOME
>    address.
>    >       This would establish a Phase II IPsec SA to use HOME address as the
>    >       source selector.
>    >
>
>    If you do this, you need a way of binding the home address to the identity
>    used in IKE MM.
>
> => I believe we need a bit more than a binding: an authorization.
> The good thing here is that we have a higher level identity and the
> static well-known address (ie. it will be far harder to "bind" the
> identity with a random care-of address).
>
How does one get to this information database ?

-mohan

---

From: Francis Dupont <[email-masked]>
Date: Fri, 22 Dec 2000 12:14:58 +0100

In your previous mail you wrote:

=> I believe the best way to do this is to put this in the certificate
(ie. a certificate policy saying "for mobility" and the home address in
another subject alternative name). But this is just an idea, there is
no accurate specifications (yet) nor a beginning of deployment.
I'd like to know how this is done in VPNs... Perhaps there is a simpler
solution already in use?

Thanks

[email-masked]

PS: this is a IPsec topic, no more a mobile IP one.