Re: [netext] Security question on anycast mode of draft-ietf-netext-redirect-01

[jouni korhonen <[e-mail]>]

Hi Julien,

On Apr 29, 2010, at 2:15 AM, Laganier, Julien wrote:

> Hello,
> 
> I have a security question on the anycast mode described in Section 1 of the draft:
> 
>   o  Support for IPv6 anycast addressing [RFC4291]: the current PMIPv6
>      specification does not specify how the PMIPv6 protocol should
>      treat anycast addresses assigned to mobility agents.  Although
>      [RFC4291] now allows using anycast addresses as source addresses,
>      it does not make much sense using anycast addresses for the MAG to
>      the LMA communication after the initial PBU/PBA exchange.  For
>      example, a blade architecture LMA may appear to the routing system
>      as multiple LMAs with separate unicast IP addresses and with one
>      or more "grouping" anycast addresses.
> 
> I understand from the above that a group of LMA would be addressed with a common anycast address, and the first PBU would be sent to this anycast address, and redirection would follow to one of the unicast addresses of a specific LMA.

Subsequent PBUs would be sent to a unicast address of a specific LMA.

> 
> If that is correct, I am wondering how will the SA between the MAG and the anycast LMA be looked up?

In the same way as SAs for unicast addresses. If SAs are build for anycast addresses, you basically have to fall back to manual keying of SAs (i.e. multiple LMAs share the same keys etc) and in most cases give up with replay protection (unless LMAs are somehow able to share sequence number state). Other than those, there is no difference to SA configuration or usage compared to the unicast case.

- Jouni



> 
> --julien