Subject: Re: Problem of interaction between SEND(CGA) and the IPv6 mobility

From: "James Kempf" <[email-masked]>
Date: Tue, 6 Jul 2004 11:07:12 -0700

Jean-Michel,

Proxy ND and the details of how to use address certificates for end hosts
are two issues the WG decided to leave out for now, until it is clearer
whether there is any interest in implementing and deploying SEND.

As a result of the IESG review, the RFC will have the following paragraph
(or something approx. like it) at the end of Section 1:

     Out of scope for this document is the use of identity certificates
     provisioned on end hosts for authorizing address use, and security of
     ND when the entity defending an address is not the same as the entity
     claiming that adddress (also known as "proxy ND"). These are
     extensions of SEND that may be treated in separate documents should
     the need arise.

I think this should address the issue you've raised.

            jak

----- Original Message ----- 
From: "Jean-Michel COMBES" <[email-masked]>
To: <[email-masked]>
Sent: Monday, June 28, 2004 4:20 AM
Subject: Problem of interaction between SEND(CGA) and the IPv6 mobility

> Hi,
>
> IMO, it would be necessary to add a warning in the Security Considerations
> section regarding the interaction between SEND(CGA) and the IPv6 mobility
> protocols.
>
> *** Problem ***
>
> This problem concerns the following IPv6 mobility protocols:
> - MIPv6 [3]
> - HMIPv6 [4]
> - FMIPv6 [5]
> - NEMO [6]
>
> For each of these protocols, the "mobility manager" (HA for MIPv6 and
NEMO,
> MAP for HMIPv6, PAR for FMIPv6) may have to intercept the packets for the
> Mobile to tunnel them to its real location.
>
> To do such a thing, the "mobile manager" uses NDP.
> As example, from RFC 3775:
> "In order to do this, when a node begins serving as the home agent it MUST
> multicast onto the home link a Neighbor Advertisement message [12] on
behalf
> of the mobile node.  For the home address specified in the Binding Update,
> the home agent sends a Neighbor Advertisement message [12] to the
all-nodes
> multicast address on the home link, to advertise the home agent's own
> link-layer address for this IP address on behalf of the mobile node.  If
the
> Link-Layer Address Compatibility (L) flag has been specified in the
Binding
> Update, the home agent MUST do the same for the link-local address of the
> mobile node."
>
> The others IPv6 mobility protocols use exactly the same mechanism.
>
> (This mechanism is not clear in FMIPv6 but it is pretty sure this is the
> same mechanism)
>
> So, if SEND(CGA) is used, the "mobility manager" MUST have the private key
> (associated to the public key used to generated the CGA address) used by
the
> Mobile to sign its ND packets.
>
> *** References ***
>
> [1] draft-ietf-send-ndopt-05.txt, "SEcure Neighbor Discovery (SEND)", J.
> Arkko (Editor)/J. Kempf/B. Sommerfeld/B. Zill/P. Nikander, April 2004
> [2] draft-ietf-send-cga-06, "Cryptographically Generated Addresses (CGA)",
> T. Aura, April 2004
> [3] RFC 3775, "Mobility Support in IPv6", D. Johnson/C. Perkins/J. Arkko,
> June 2004
> [4] draft-ietf-mipshop-hmipv6-02.txt, "Hierarchical Mobile IPv6 mobility
> management (HMIPv6)", H. Soliman/C. Catelluccia/K. El Malki/L.Bellier,
June
> 2004
> [5] draft-ietf-mipshop-fast-mipv6-01.txt, "Fast Handovers for Mobile
IPv6",
> R. Koodli (Editor), January 2004
> [6] draft-ietf-nemo-basic-support-03.txt, "Network Mobility (NEMO) Basic
> Support Protocol", V. Devarapalli/R. Wakikawa/A. Petrescu/P. Thubert, June
> 2004
>
>
> Regards.
>
> JMC.
>
> France Telecom - R&D Division - MAPS/NSS
> Jean-Michel COMBES, Internet/Intranet Security
> E-Mail: [email-masked]
> Phone: +33 (0)1 45 29 45 94
> Fax: +33 (0)1 45 29 65 19
> Mobile: +33 (0)6 07 29 30 16
>
>
> --------------------------------------------------------------------
> To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
> body to <[email-masked]>.
> Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
> --------------------------------------------------------------------
>

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------