Re: [netext] Review of draft-ietf-netext-access-network-option-00

[Carlos Jesús Bernardos Cano <[e-mail]>]

Hi Jouni,

Thanks for your comments. Some additional ones from my side below.

On Tue, 2011-11-01 at 15:29 +0200, jouni korhonen wrote:
> Carlos,
> 
> Thanks for the review. See some responses inline.
> 
> On Oct 30, 2011, at 9:51 PM, Carlos Jesús Bernardos Cano wrote:
> 
> > Hi all,
> > 
> > I've read draft-ietf-netext-access-network-option-00 and I have some
> > comments:
> > 
> > - I think the document is OK in general.
> > - The normative text of Section 3 needs to be revised. For example,
> > there are lots of normative words in lowercase.
> 
> Ok.
> 
> > - Can a PBU carry more than one ANI option? It is not clearly mentioned,
> > though Figure 1 may indicate it is possible (as there is both BSSID and
> > Geo-Loc shown as part of the identification of the access network.
> 
> There can be one ANI option.. as you can access only one operator network at once.
> 
> The option structure is still in flux so it is likely to change a bit in the future. For example there might be cases where multiple network identifiers are useful (e.g. SSID accompanied with geo-location etc).

This is exactly what I was referring to. In the current draft, it seems
that multiple network identifiers can be conveyed, but this seems not
possible to be done with a single ANI option (as currently defined).

> 
> > - Figure 3 is not referred in the document.
> > - I think there should be text dealing with the case in which an LMA not
> > supporting/understanding the ANI option receives a PBU carrying one.
> 
> Ok. You mean a simple capability confirmation like echoing the ANI option back in the PBA? Or something else?

Well, just some text explaining what an LMA will do in that case. Maybe
just ignore the ANI option, but this needs to be mentioned in the draft,
IMHO.

> 
> > - It seems that included Nw-ID types are 802.11 related. Is there no
> > other case (e.g., 3GPP related) worth including?
> 
> This is the initial set. If you have additional Nw-IDs to propose with a good use case, go ahead :)

OK, I'll try that exercise :)

> 
> > - Does the ANI option introduce privacy issues? In case an attacker was
> > able to overhear PBUs, it could be able to know where a particular MN is
> > geographically located. Not sure this is a realistic concern in a real
> > deployment, but authors might want to mention that IPsec encryption
> > could be used to mitigate this problem.
> 
> I think we do not need to go beyond existing RFC5213 security.. Even MN-ID option introduces a privacy issue more or less.

Well, I'm not an expert but I think this deserves at least a second
look. Jong-Hyouk also expressed some concerns about this. At least, I
think this should be mentioned on the Security Considerations section,
IMHO.

Thanks,

Carlos

> 
> - Jouni
> 
> 
> 
> > 
> > Thanks,
> > 
> > Carlos
> > 
> > -- 
> > Carlos Jesús Bernardos Cano  http://www.netcom.it.uc3m.es/
> > GPG FP: D29B 0A6A 639A A561 93CA  4D55 35DC BA4D D170 4F67
> > _______________________________________________
> > netext mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/netext
> 

-- 
Carlos Jesús Bernardos Cano  http://www.netcom.it.uc3m.es/
GPG FP: D29B 0A6A 639A A561 93CA  4D55 35DC BA4D D170 4F67