Subject: RE: [mobile-ip] MIPv6 IPSEc and s=0

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 14 Jan 2003 10:08:48 -0800

> > 
> >>Jari Arkko wrote:
> >>
> >>
> >>>(b) Warn the administrators of this issue in the document,
> >>>    require an administrative procedure to prevent this.
> >>>    + Easy to do
> >>>    - Admins might be missing this check
> >>>    - Makes the configuration task a bit harder (and it already is
> >>>      hard)
> >>
> >>Here's some potential text for this alternative. Comments
> >>appreciated. Which alternative do folks want to pick? I'm
> >>leaning on (b) myself at this hour, given that if interface
> >>identifier collisions are allowed to develop, we have more
> >>serious problems that just security: its hard for the colliding
> >>mobile nodes to get any service due to link-local DAD checks.
> >>
> >>The text is expected to be added after the second paragraph
> >>in Section 5.2 [1]:
> >>
> >>    "Note that when the Single Address Only (S) bit has been
> >>     set to zero, bindings for several home addresses may be
> >>     affected, all with the same interface identifier. Only one
> >>     of these addresses appears in the packet, however, and the
> >>     IPsec policy checks are based on that address. Such checks
> >>     are therefore unable to verify that the correct security
> >>     association was used, had the address been one of the other
> >>     ones. For this reason (and in order to avoid Duplicate Address
> >>     Detection conflicts), home agents SHOULD NOT be
> >>     configured to serve different mobile nodes with the
> >>     same interface identifier.
> > 
> > Ok.
> > 
> >>     Instead, it is recommended
> >>     that the for each mobile node, security associations
> >>     are configured to the same node for all combinations of
> >>     available home subnet prefixes and the node's interface
> >>     identifier(s).
> > 
> > I am not sure i understand this statement. You recommendation was to
> > check for IID collisions. You still have one SA per MN 
> bound to just one
> > home address. This seems to suggest have more than one SA 
> assuming i am
> > reading it correctly. Could you clarify ?
> 
> Looking at the text now, I should change "Instead" to "Additionally",
> since the check and the creation of multiple SAs are not alternatives.
> The intention was just to say that when you configure a new
> mobile node, you should set up all the possible SAs for it at
> the same time. If there are no IID collisions, these SAs will be
> unique.
> 
Ok, this specifically talks about setting up of manual SAs. Why do you
need one SA per home address if binding update is always sent with just
one home address which is also what the IPsec policy checks are based on ?

What i understood from your proposal was that s=0 does not require anything
new in IPsec but just the warning for admins to prevent IID collision.
If this is true, there is just one SA which is bound to one home address and
the binding update comes with that address and policy checks happen against
that address and implicitly authorizes for all the other addresses.
Am i mistaken ?

-mohan

> Jari

---

From: Jari Arkko <[email-masked]>
Date: Wed, 15 Jan 2003 00:31:47 +0200

> that address and implicitly authorizes for all the other addresses.

No, you are quite right. But the recommendation was to set up all the
SAs regardless of the fact that just one hoa and one sa might actually
get used when S=0.

Jari