IETF Logo Mail Archive

Re: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

Francis Dupont <Francis.Dupont@enst-bretagne.fr> Tue, 25 October 2005 16:56 UTC

Received: from localhost.localdomain ([127.0.0.1] helo=megatron.ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUS5y-0003P7-NX; Tue, 25 Oct 2005 12:56:18 -0400
Received: from odin.ietf.org ([132.151.1.176] helo=ietf.org) by megatron.ietf.org with esmtp (Exim 4.32) id 1EUS5w-0003P0-En for mip6@megatron.ietf.org; Tue, 25 Oct 2005 12:56:16 -0400
Received: from ietf-mx.ietf.org (ietf-mx [132.151.6.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA04891 for <mip6@ietf.org>; Tue, 25 Oct 2005 12:56:02 -0400 (EDT)
Received: from coliposte.enst-bretagne.fr ([192.108.115.12]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1EUSIu-0002Jv-MC for mip6@ietf.org; Tue, 25 Oct 2005 13:09:42 -0400
Received: from localhost (localhost.localdomain [127.0.0.1]) by coliposte.enst-bretagne.fr (8.12.10/8.12.10/2004.10.03) with ESMTP id j9PGtrhR017670; Tue, 25 Oct 2005 18:55:53 +0200
Received: from givry.rennes.enst-bretagne.fr (givry.rennes.enst-bretagne.fr [193.52.74.194]) by coliposte.enst-bretagne.fr (8.12.10/8.12.10/2004.09.01) with ESMTP id j9PGt3ls017495; Tue, 25 Oct 2005 18:55:03 +0200
Received: from givry.rennes.enst-bretagne.fr (localhost.rennes.enst-bretagne.fr [127.0.0.1]) by givry.rennes.enst-bretagne.fr (8.13.1/8.13.1) with ESMTP id j9PGt4Ta007676; Tue, 25 Oct 2005 18:55:04 +0200 (CEST) (envelope-from dupont@givry.rennes.enst-bretagne.fr)
Message-Id: <200510251655.j9PGt4Ta007676@givry.rennes.enst-bretagne.fr>
From: Francis Dupont <Francis.Dupont@enst-bretagne.fr>
To: Gerardo Giaretta <Gerardo.Giaretta@tilab.com>
Subject: Re: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt
In-reply-to: Your message of Tue, 25 Oct 2005 15:32:22 +0200. <DA62A6E0CDD1B34A84557FF1AC850C57016E9CDC@EXC01B.cselt.it>
Date: Tue, 25 Oct 2005 18:55:04 +0200
X-Virus-Scanned: amavisd-new at enst-bretagne.fr
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 9182cfff02fae4f1b6e9349e01d62f32
Cc: mip6@ietf.org, Kilian Weniger <Kilian.Weniger@eu.panasonic.com>, Petrescu Alexandru-AAP021 <alexandru.petrescu@motorola.com>, James Kempf <Kempf@docomolabs-usa.com>, COMBES Jean-Michel RD-MAPS-ISS <jeanmichel.combes@francetelecom.com>
X-BeenThere: mip6@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: mip6.ietf.org
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/mip6>, <mailto:mip6-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:mip6@ietf.org>
List-Help: <mailto:mip6-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/mip6>, <mailto:mip6-request@ietf.org?subject=subscribe>
Sender: mip6-bounces@ietf.org
Errors-To: mip6-bounces@ietf.org

 In your previous mail you wrote:

   Besides the motivation why a MN will prevent another HA that is
   theoretically more loaded, the operator may let the HA refuse the IPsec
   SA setup during IKEv2 through its AAA infrastructure. But I agree this
   is not a clean approach.
   
=> it is not so bad but:
 - it is not so easy to implement (another IKE/MIPv6 interaction,
   the MIPv6 codes I know try other HAs when BUs fail)
 - with a timeout it is not efficient, with an ICMP message it is
   a security hole (trivial DoS)
 - any secured mechanism will take time and participate to the load

   DHCP-based solution seems to achieve this. Do you see any issue on that?
   
=> I know well DHCPv6 and I don't believe it is the right tool for
this job. I'll comment the general bootstrapping draft
(draft-ietf-mip6-bootstrapping-integrated-dhc-00.txt isn't it?)
because there are many ways to use DHCPv6, including just transmitting
AAA stuff to the MN...

Regards

Francis.Dupont@enst-bretagne.fr

_______________________________________________
Mip6 mailing list
Mip6@ietf.org
https://www1.ietf.org/mailman/listinfo/mip6

v2.23.0 | Report a Bug | By Email