Re: [netext] Stephen Farrell's Discuss on draft-ietf-netext-pmip-cp-up-separation-05: (with DISCUSS and COMMENT)

["Sri Gundavelli (sgundave)" <[e-mail]>]

Thanks Stephen. We will go with that text then.



On 8/28/14 5:02 AM, "Brian Haberman" <[e-mail]> wrote:

> If WG members disagree
>with the proposed changes, they are free to raise that disagreement.  If
>the resulting changes are substantive, I will ask the chairs to review
>those changes with the WG prior to any publication approval.


The proposed text on IPsec is inline with the base spec. We kept the
following original agreements.

1.) Protection for PMIPv6 signaling messages with end-to-end security
association(s) offering integrity and data origin authentication.
2.) IPsec is a mandatory to implement on CP nodes
3.) IPsec is mandatory to implement on UP nodes
4.) Use of IPsec for user plane traffic protection is optional
5.) New specifications can be define alternative security mechanisms for
protecting signaling messages


This is inline with the text in RFC-5213. My comment was on #3, where the
implementation of IPsec was mandated indirectly by having a requirement
for CP traffic protection. Nothing substantial. Explicit statements on the
protocol security for the split CP/DP architecture.


Working Group:

Any comments on the below text, please speak up.



NEW:

The Proxy Mobile IPv6 specification [RFC5213] requires the signaling
messages between the MAG and the LMA to be protected using end-to-end
security association(s) offering integrity and data origin authentication.
The base specification also requires IPsec a mandatory-to-implement
security mechanism.

In deployments where the Control and User Plane functions on the MAG and
LMA are separated and hosted on different IP nodes, the nodes hosting
those respective Control Plane functions have to still meet the above the
security requirement. The Proxy Mobile IPv6 signaling messages exchanged
between these entities MUST be protected using end-to-end security
association(s) offering integrity and data origin authentication.
Furthermore, IPsec is a mandatory-to-implement security mechanism for the
nodes hosting the Control Plane function of the MAG and LMA. Additional
documents may specify alternative mechanisms and the mobility entities can
enable a specific mechanism for securing Proxy Mobile IPv6 signaling
messages, based on either a static configuration or after a dynamic
negotiation using any standard security negotiation protocols.

As per the Proxy Mobile IPv6 specification, the use of IPsec for
protecting the mobile node's user plane traffic is optional. This
specification extends the same requirement and therefore requires the
nodes hosting the User Plane functions of the MAG and the LMA to have
IPsec as a mandatory-to-implement security mechanism, but make the use of
IPsec as optional for User Plane traffic protection.


Regards

Sri