Subject: Re: [nemo] RE: Explicit Prefix Length Option

From: "James Kempf" <[email-masked]>
Date: Tue, 25 Nov 2003 09:03:04 -0800

Pascall,

I think what Alexis is trying to get at is the following. Suppose there are
two mobile routers, both having IPsec SAs with the HA. One has IP address A
and the other has IP address B. Router A is allowed to route prefix set X
and router B is allowed to route prefix set Y.

What prevents router A from sending a BU with Prefix Option having the
prefixes in set Y, thereby hijacking B's traffic?

This is the point I was trying to get at about service provider deployment
security (sorry if I was a bit cryptic).

            jak

----- Original Message ----- 
From: "Pascal Thubert (pthubert)" <[email-masked]>
To: "Alexis Olivereau" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, November 25, 2003 3:41 AM
Subject: RE: [nemo] RE: Explicit Prefix Length Option

>
>
> > -----Original Message-----
> > From: Alexis Olivereau [mailto:[email-masked]]
> > Sent: mardi 25 novembre 2003 12:29
> > To: Pascal Thubert (pthubert)
> > Cc: [email-masked]
> > Subject: Re: [nemo] RE: Explicit Prefix Length Option
> >
> > > Pascal Thubert (pthubert) wrote:
> > > This is what I was trying to say. Keep the MIPv6 model, and
> > > implicitly extend that authorization to a given prefix length around
> > >  the static home address. You can configure that HA to accept the
> > > registration for a prefix around the home address, provided that the
> > >  MR has proven its identity (the MIPv6 way), and with a minimum
> > > configured prefix length. The explicit prefix extends the implicit
> > > authorization in MIPv6.
> > >
> > > This is what I was trying to say. Keep the MIPv6 model, and
> > > implicitly extend that authorization to a given prefix length around
> > >  the static home address.
> >
> > I am not sure I understand what you are proposing here. Do you mean
> that
> > a Mobile Router would be able to claim the ownership of any prefix
> above
> > a certain length, provided that the prefix is based on its home
> address?
> > Then I could imagine cases where two Mobile Routers could legitimately
> > claim the ownership of the same prefix... Or we need to add more
> > constraints on how the MRs' home addresses are assigned.
>
> This is entering the multihomeing discussion. In that case, yes, that
> would be possible.
> We do not have a test to check that multiple registration of a given MNP
> lead to a unique mobile link. With basic, we assume that the
> configuration is correct and that the authorization checks that there is
> no abuse.
>
> Pascal
>
>
>