[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Mobile IPv6 - IPsec interaction.

 In your previous mail you wrote:

   Francis Dupont <Francis.Dupont@enst-bretagne.fr> writes:
   
   [my example snipped]
   
   > => so your proposal is to use the manual setup. At least one free
   > implementation has this, in FreeS/WAN this gives on the home agent:
   
   No, I was just giving that as an example of one way of doing it.
   You could just as easily use DNSSec to do key distribution.
   
=> the problem of key distribution is a bit different. Today DNSSEC
is not really available and X.509v3 certificates are used (this raises
two issues:
 - no common PKI
 - no standardized way to bind the identity to the home address
   (DNS has builtin name-address binding so DNSSEC is far better,
    unfortunately I should have written "will be far better")).

   [freeswan example snipped]
   
   > So we can say the issue is solved for the home agent but of course
   > manual config doesn't scale and won't work for random correspondents,
   > ie. we should look for an automatical and standardized way to do this...
   
   Well, as I said, you don't need to use manual config.  Well, that's
   not true -- the home agent does need to be configured with it's mobile
   hosts, so frankly requiring some "manual" configuration is not asking
   a lot.

=> I agree for the home agent but this argument doesn't work for "random"
correspondents.

   As for random correspondants who aren't using the home address, you
   have a much harder problem.  Personally, I would punt on IPSec to
   solve that problem and just build a signed message that contains the
   home address, care-of address, current time, and ttl (and maybe other
   information).

=> this kind of message will be sent by the mobility code but after
SAs are established. The order of operations are:
 - the mobile initiates a phase I using its care-of address
   (ie. using direct communication as a "road warrior")
 - the mobile establishes SAs in phase II for its home address
 - the mobile sends a mobile "binding update" which must be authenticated,
   checked for integrity and protected against replay (both by IPsec
   and an internal sequence number). From a IPsec point of view,
   the binding update message seems to come from the home address.
The issue is to solve the authorization in phase II and mobile IPv6
relies on IPsec policy to do this so the issue is how to express this
kind of policy. We have proved that manual config works but we need
a more scalable way (DNSSEC seems to be a good proposal because it knows
how to bind securely a name to an address but we should write down details
and wait for DNSSEC if we'd like to deploy this solution).

   Then you can send that binding message to anyone you
   wish.  Correspondant nodes can obtain keys from DNSSec to verify the
   message, based on the home address.
   
=> we should write down the details, for instance what is used for
DNSSEC lookup (a name from phase I identity or the home address).

   The only problem with this approach is that you cannot prove that you
   are authorized to use that care-of address.

=> this doesn't matter: this is a visited network problem.

  The only way to solve _that_ problem is to require the foreign agent
  to sign the binding update as well.

=> there is no foreign agent in mobile IPv6...

Thanks

Francis.Dupont@enst-bretagne.fr

PS: is there other IPsec implementation usage of DNSSEC than FreeS/WAN
experimental key distribution?
PPS: a raw proposal is to encode the phase I identity into a DNS name
(easy for FQDN :-) and to put an A/A6/AAAA RR to the home address signed
with a SIGN RR using the mobile node private key.
References: