Re: [nbs] NBS and TCP connection identification

Hi Christian,

In my understanding NBS and address changes can remain independent, and therefore should remain so.
- A connection initiation starts with the source and destination names chosen by the initiator (and with valid addresses for them at that time).
The acceptor advertises at the NBS the names it received.
It may have before that checked, with a direct a DNS query, that source address and source name are consistent, or do it after signaling the incoming connection, or never, at its own choice. 
- Shim6, if present, works as before.

Does this make sense to you?

RD

Le 28 sept. 2010 à 00:20, Christian Vogt a écrit :

> 
> Erik Nordmark wrote:
> 
>> How do you secure the movement in that case?
>> Suppose the client has IP address 129.146.228.81, thus the server would 
>> see the client as having name 81.228.146.129.in-addr.arpa.
>> Then the client switches to being on IP address 36.1.2.3. How can you 
>> know that it is indeed the same client so that it is secure for the 
>> server to start sending the packets to 36.1.2.3?
>> You can't rely on DNS validation (unless you assume that the client can 
>> update the DNS records for 81.228.146.129.in-addr.arpa, which is very 
>> unlikely.)
>> Thus how do you secure this?
> 
> 
> Erik,
> 
> a way to secure IP address changes without the help of Shim6 would be the following:
> 
> - Exchange a randomly generated token at the old IP address.
> 
> - Verify the peer's knowledge of this token at the new IP address.
> 
> - Upon successful verification, associate the peer's new IP address with the peer's DNS name, which happens to encode the IP address that the peer had used during session initiation.
> 
> This procedure would be very similar to the Mobile IPv6 care-of address check.
> 
> - Christian
> 
> _______________________________________________
> nbs mailing list
> nbs@ietf.org
> https://www.ietf.org/mailman/listinfo/nbs