Subject: RE: FW: [mobile-ip] AD question on authorization in draft-ietf-mobileip-reg-revok-04.txt

From: [email-masked]
Date: Fri, 14 Feb 2003 14:13:43 -0600

> [email-masked] writes:
>  > > 
>  > > Even if there are two or n-zillion SA's,
>  > > authorization checks must still be
>  > > performed. Beware the conflation of auth and
>  > > authz! In general, I don't see that there's a huge
>  > > problem with only having only one SA between the
>  > > HA and FA... Each side, however, needs to keep
>  > > track of which bindings may be manipulated by
>  > > which FA/HA.
>  > 
>  > In the revised draft (05), the mobility agents are aware
>  > whether the revoking agent supports the ability to have
>  > multiple revocations done with a single message i.e the
>  > support for various masks by either of the agents is known
>  > up front. 
> 
>    The issue really has nothing to do with multiple
>    revocations. For each revocation request -- whether in
>    a single packet or across many -- the identity of
>    requestor must be checked against who is authorized
>    to modify the binding. Normally, that would be the
>    destination HA/FA. We can't have a situation where
>    a rogue HA/FA is allowed to modify bindings of an
>    unrelated HA/FA, and that purely a question of 
>    authorization.

Completely agree. And that is why the Revocation message includes
an authenticator which is what prevents a rogue HA/FA sending
revocation messages. For revoking multiple registrations it is
recommended that there exist a strong SA between the agents
such as an IPsec SA.
> 	Mike

-Basavaraj

---

From: Michael Thomas <[email-masked]>
Date: Fri, 14 Feb 2003 12:22:06 -0800 (PST)

> recommended that there exist a strong SA between the agents

   Let's see if we're really in agreement here: I'm
   talking about a rogue HA/FA which still can produce
   an otherwise valid authenticator. That is, I can 
   prove who I am cryptographically, but I may still
   try to modify bindings which do not belong to me.

   Just throwing authentication at the problem does
   *not* solve this problem, and in fact IPsec as
   evidenced by MIPv6 becomes rather much a pain
   unless you perform the authz check outside of
   IPsec.

	Mike

---

From: "Steven M. Glass" <[email-masked]>
Date: Fri, 14 Feb 2003 15:39:09 -0500

>    try to modify bindings which do not belong to me.

     Not to speak for Raj, but this is how I've been taking what's been 
said, and I'm in agreement.  This is what the clarifying part of the 
document which Thomas included in his last email was making sure was 
clear.  To rephrase what Madhavi just said, FA1 must be the only FA 
that can revoke bindings that exist between FA1 and HA1, and HA1 must 
be the only HA that can revoke bindings that exist between FA1 and HA1.

                               Cheers,
                                   Steve

---

From: Michael Thomas <[email-masked]>
Date: Fri, 14 Feb 2003 12:36:04 -0800 (PST)

Ok, good.

	Mike