Subject: [mobile-ip] AD question on authorization in draft-ietf-mobileip-reg-revok-04.txt

From: Thomas Narten <[email-masked]>
Date: Thu, 02 Jan 2003 15:27:39 -0500

I have some questions about authorization that I wonder if they have
been thought through sufficiently, or whether I just don't
sufficiently understand some underlying assumptions. In particular,
the question I have concerns how useful some of the more general
operations allowed by the Revocation Mask actually are.

First, the key part of authorization seems to be:

> Note that the scope of the revocation MUST only apply to the subset of
> bindings between the revoking agent, and the agent receiving the
> revocation message. For example, if foreign agent x.y.z.t sends a
> revocation message to home agent a.b.c.d for mobile node subnet
> a.b.c.0, and sets the revocation mask to 0x01, the home agent MUST NOT
> revoke all of its bindings for mobile nodes on the same home link as
> the revoked mobile node, but only those mobile nodes that are also
> visiting the foreign agent sending the revocation message.

Is this correct? Seems to me like the *only* operations that should be
allowed are those that are authorized by a particular security
association. If I have two MNs, both from the same Home Domain, both
visiting the same Foreign Domain (and using the same HA and FAs), will
there be a single Security Association between the HA and FA (covering
both MNs) or will there be two (i.e., separate ones for the two MNs)?
I would have assumed there would be two separate ones. If this is the
case, the scope of what a particular revocation can do is limited to
the one MN, and many/most of the operations implied by the Revocation
Mask don't seem to be very useful (because they can't really be
authorized in general).

What I'm trying to understand is what is safe to be authorized. E.g.,
if an FA gets a revocation message from an HA, just how does the FA
know which of the bindings it has are authorized to be released by a
specific revocation message?  It does not seem sufficient to just say
(as above) "subset of bindings between the revoking agent and agent
receiving the revocation message". All revoked bindings must be tied
together by a shared security relationship.

Does this make sense?

Thomas

---

From: Mike Borella <[email-masked]>
Date: Thu, 2 Jan 2003 17:57:19 -0800 (PST)

> Mask don't seem to be very useful (because they

If there is a shared secret for an SA there really
should be a way to refresh it every so often.  This is
easy to do if the SA is per mobile (limit the length
of a call to a few days) but difficult if potentially
many mobiles are sharing the same SA.  

As for revocation, IMO the only codes that make sense
are 0x01, 0x02 and 0x08.  In other words, "revoke this
particular registration" or "revoke all of my
registrations".  I can't think of why the subnet or
domain based codes would be used except to support
corner cases.  (Someone correct me if I'm wrong...)

So, in the revoke-all case, if we have one SA, no
problem.  If we have multiple SAs, which one do we
use? One could argue that any SA would be ok, since
the trust relationship is between the FA and HA, but
that would prevent different mobiles using these
components to acquire different policies and
treatment.  While in most cases, different mobiles
using the same FA and HA would have identical policy,
that won't always be true. 

Mike

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com