Re: SEND-based protection and related confusions (was RE: AR compromise(Re: [Mipshop] Review ofdraft-haddad-mipship-hmipv6-security-04))

[Jari Arkko <jari.arkko at piuha.net>]

Lakshminath Dondeti wrote:

> I started with 4140's security considerations; that seems like a good
> starting point.

I read the 4140 security considerations. They are indeed a good
starting point. I particularly liked the description of what
authorization is needed for regional care-of-address
allocation.

There were a few things that I started to wonder
about though, such as:

- How important in reality the service authorization part is?
  You could also view this as an IP level service that is
  simply available in this network. (4140 classifies this
  as a MAY requirement, which I agree with.)

- However, it may be important for the mobile node to
  get an assurance that the MAP is authorized to act
  as a MAP. And perhaps authorized to act as a MAP
  in THIS network?

  That is, do we need security for the discovery of the
  MAP? Or, how does the mobile node authorize the
  MAP? Is it enough that it is one of the trusted MAPs
  in the roaming consortium?

- Is there a privacy requirement with respect to
  disclosing regional care-of-addresses to other
  nodes in the domain (e.g. in a BU sent to a MAP)?

--Jari


_______________________________________________
Mipshop mailing list
Mipshop at ietf.org
https://www1.ietf.org/mailman/listinfo/mipshop