Subject: [nemo] Re: [MPI]Comments on draft-eddy-nemo-aero-reqs-00.txt

From: marcelo bagnulo braun <[email-masked]>
Date: Sat, 30 Jun 2007 11:34:51 +0200

catching up with this....

El 07/06/2007, a las 20:10, Wesley Eddy escribió:

>
> I understand that the MIPv6 basic RO security isn't IPsec based, but I
> don't see this as a good reason not to require the NEMO RO to be
> securable through IPsec.  The MIPv6 RO security wasn't built on IPsec
> because it was felt that the needed PKI structure didn't exist.  With
> recent work like BTNS, I believe this concern could be revisited.

I am not sure BTNS could provide the security required by a nemo ro 
solution. BAsically BTNS is an unathenticated mode of using IKE/IPSec. 
The whole point of RO security is proving address/prefix ownership, 
which is exactly what btns lacks. I mean, btns approach is basically a 
leap of faith approach, where basically it makes sure that the 
communication peer remains the same that the one contacted at the 
begining of the communication. But in nemo RO this is not enough, 
basically becasue the one that initiated the contact maybe an attakcer 
trying to hijack a prefix. so, i seriously doubt btns could do the work 
needed for securing nemo ro....

Regards, marcelo

>  RO
> security based on BTNS seems reasonable to me (for both MIPv6 and 
> NEMO),
> since it could ensure that communications through the HA are with
> identical parties as those over the RO path, and it leverages the
> existing IPsec mechanisms.
>
> I would like to hear other opinions about this.  Particularly, answers
> to the questions "Why *not* require securability via IPsec?" would be
> helpful.
>
> -- 
> Wesley M. Eddy
> Verizon Federal Network Systems
>
> #############################################################
> This message is sent to you because you are subscribed to
>   the mailing list <[email-masked]>.
> To unsubscribe, E-mail to: <[email-masked]>
> To switch to the DIGEST mode, E-mail to <[email-masked]>
> To switch to the INDEX mode, E-mail to <[email-masked]>
> Send administrative queries to  <[email-masked]>
>