Re: [netext] Security question on anycast mode of draft-ietf-netext-redirect-01

[jouni korhonen <[e-mail]>]

Hi Julien,

On Apr 29, 2010, at 2:15 AM, Laganier, Julien wrote:

Hello,

I have a security question on the anycast mode described in Section 1 of the draft:

o  Support for IPv6 anycast addressing [RFC4291]: the current PMIPv6

   specification does not specify how the PMIPv6 protocol should

   treat anycast addresses assigned to mobility agents.  Although

   [RFC4291] now allows using anycast addresses as source addresses,

   it does not make much sense using anycast addresses for the MAG to

   the LMA communication after the initial PBU/PBA exchange.  For

   example, a blade architecture LMA may appear to the routing system

   as multiple LMAs with separate unicast IP addresses and with one

   or more "grouping" anycast addresses.

I understand from the above that a group of LMA would be addressed with a common anycast address, and the first PBU would be sent to this anycast address, and redirection would follow to one of the unicast addresses of a specific LMA.

Subsequent PBUs would be sent to a unicast address of a specific LMA.

If that is correct, I am wondering how will the SA between the MAG and the anycast LMA be looked up?

In the same way as SAs for unicast addresses. If SAs are build for anycast addresses, you basically have to fall back to manual keying of SAs (i.e. multiple LMAs share the same keys etc) and in most cases give up with replay protection (unless LMAs are somehow able to share sequence number state). Other than those, there is no difference to SA configuration or usage compared to the unicast case.

- Jouni

--julien