RE: CGA-based HoA generation for MIP6 (was RE: [Mipshop] Review of draft-arkko-mipshop-cga-cba-04)

> -----Original Message-----
> From: Jari Arkko [mailto:jari.arkko@piuha.net] 
> 
> Christian Vogt wrote:
> 
> >From a security perspective, I don't currently see a requirement for 
> >the HA to know that the HoA is CGA-based, given that all 
> MN-HA security 
> >is
> >IPsec-based:
> >
> Agreed.
> 

I don't know that this is true. As we know, what we get from IPsec and
CGAs are quite orthogonal benefits. In the case where the HA assigns the
HoA via IKEv2, HoA authorization at the HA is not needed, since the HA
knows that the IPsec SA is tied to the owner of the corresponding HoA.
Now, systems that allow stateless autoconfiguration of HoAs may or may
not want to ensure that those IP addresses are authorized and verified.
If a system employs CGAs in the network, it is actually an indication
that the system deployment cares about IP address ownership
verification. In this case, it actually seems to me that the HA being
able to verify the CGA would be very valuable and needed. 

> >From a practical standpoint, there may be a benefit for the 
> HA to know 
> >that the MN's HoA is CGA-based.
> >  
> >
> Its possible to design mechanisms that employ the same tools 
> also for the home agent registrations, or use the help of the 
> home agent in the RO process. Such mechanisms would likely 
> have some advantages. 

Yes, I agree with the above. For this purpose, I think we should analyze
this further to see how best RO can be actually optimized. Actually,
considering all of this is why I suggested that if we want to get an RFC
on the cga-cba work now, it should preferably be experimental, so that,
we can move it to PS after we fully analyze the space and are convinced
this is optimized in the best possible way. 

> OTOH, there is also some value in 
> keeping the two RO and HA registration mechanisms separate. 
> E.g., you don't have to sync HA and MN code updates. IKEv2, 
> auth option, and RFC 3776 all can support CGAs, though some 
> with extra config effort.
> 

Given that MIP6 hasn't seen much deployment yet and that RO is not even
considered in the pipeline yet in most planned MIP6 deployments even, I
am not so concerned about code updates. I think we should work towards
getting a fully optimized solution, so that RO in general starts looking
more attractive than it currently is. 

Vidya

_______________________________________________
Mipshop mailing list
Mipshop@ietf.org
https://www1.ietf.org/mailman/listinfo/mipshop