[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [MEXT] Review of draft-ietf-mext-binding-revocation-03.txt

Ahmad Muhanna wrote:

Hi Vijay,
Ahmad, if there is a security threat by a MAG deleting the binding it created, let me know. Otherwise the authorization check is unnecessary. Please remove it. 

[Ahmad]
The simple answer is yes. IMO, compromised MAG is applicable here as it
was applicable in PMIPv6.
The problem with Global revocation is: the consequences is much more
sever. One single message impact all bindings between the MAG and the
LMA. Adding this authorization check, is NOT a huge overhead. It ensures
that this MAG is authorized to participate in such activity, which MAY
NOT happen that frequently anyway. Also, it gives LMA the freedom  to
NOT allow some MAG(s) to do such activity.

As an example: let us assume that MAG1 will send a Global Revocation at
time (t1) and MNx will attach at time (t1+ 30 seconds). Why it is
acceptable for the LMA to make sure that the MAG1 is authorized to send
a PBU on behalf on MNx while it is not needed to validate that it is
authorized to delete 10k sessions (for example) in a single message.
This is a wrong analogy. Currently RFC 5213 does not require the LMA to perform an extra authorization check when deleting a binding when it receives a de-registration PBU from the LMA. So why require the authorization check for bulk revocation? It is the MAG that created the bindings.
In addition, the authorization check that is described in draft-ietf-mext-binding-revocation-03.txt seems to be saying that the LMA must check if the MAG is authorized to do bulk revocation. Not about the MAG being authorized to modify the binding related to mobile node session. Why do you want the LMA to maintain a list of MAGs that are authorized for bulk revocation? How is this list configured on the LMA?
[BTW: This has been in the draft since inception and has been discussed many times and was approved during the wg LC] 
Has it been discussed specifically?


[Ahmad]
Yes. We did. In several occasions. Please check exchanges with Domagoj, Patrick, and others. 

I couldn't find anything on this. Can you please give me a pointer?
3. If there is a Peer Authorization Database already as per PMIPv6, why it is TOO difficult to add the authorization for the 
Global Revocation.

Are you talking about IPsec PAD?


[Ahmad]
That could be used too. I do not see any problem with that.
See section 4.4.3 of RFC 4301 for the PAD definition. How can this be used by the LMA to check if the MAG is authorized for bulk revocation? 

Vijay