Subject: Re: draft-daley-send-spnd-prob-00 comments

From: Greg Daley <[email-masked]>
Date: Sat, 19 Feb 2005 13:03:22 +1100

Hi Pekka,

sorry I took so long to find this e-mail.

I read it today when going back over proxy ND.

Pekka Savola wrote:
> Hi,
> 
> (this is out of scope for the WG for now I recall, but seeming the 
> list is quite, there shouldn't be any harm..)
> 
> Thanks for writing this out.  It's still a bit sketchy, of course, but
> hopefully could be used to focuse the thinking wrt. whether there is any
> hope for Proxy Neighbor Discovery security.
> 
> Just two comments:
> 
>  - You implicitly assume only Proxy ND in the traditional (MIPv6) sense, but
> it could be applied in more general with the Proxy-ND spec as well (esp. if
> the rbrigde effort doesn't get going).

I've just done this in -01.

>  - section 7.2 on Certificate Transport could use a bit more context.  I was
> confused about which scenario you are considering here -- whether the node
> is roaming, but is coming home; or at home but leaving (or already left); or
> both (or something else). Two unboiled thoughts: 

This may still be the case, I'll check this.

>    1) if the MN knows HA's
> address and public key using mechanisms which are out of scope from here
> (based on the associating with the HA in the first place), what's still
> missing here -- couldn't the MN send its signed authorization along with the
> Binding Update, the HA could take it to use, and then send BA?  

Yes, it could.  The MN is a good candidate to have a preestablished
relationship with a HA, and could just sign its authority beforehand.

The only difficulty is the size of the certificate.
The cert would have to travel in a very large mobility option.
Currently these are TLVs with 8-bit lengths (to 256 octets).

The certificate could be passed in another message, perhaps covered
by the same (or a related) SA, at binding time.
The BU would refer to the certificate, and the BAck would wait for the
certificate to arrive and be processed, as you mentioned.

Your suggestion (and its variations) are worth adding.

>   2) can this
> be simplified if one could assume that MN has to be at home at first (or at
> least get its certificate to the HA configured at HA somehow), before moving
> or coming home?  This would assume that such certificates could be
> sufficiently long-lived.
> 

Yes, it could.  The MN could send a certificate path advertisement
to the HA before leaving.  It would be necessary for the HA to
recognize what to do with it.

I'll add that too.

I'm not sure if the modifications will get in before Monday though.

The proxy-send work is likely  to be in Mobopts for now,
unless IPv6 wants to review its implications for NDproxy.

Greg
--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------