Subject: Re: security review of draft-ietf-mip6-ha-switch-03.txt

From: Jari Arkko <[email-masked]>
Date: Tue, 18 Sep 2007 20:37:16 +0300

Thanks for your review, Patrick!

Comments inline:

> I expect that the biggest risk of telling a mobile agent to use a new home
> agent 
> is the threat of impersonation, i.e., moving home agents so as to insert a
> woman-in-the-middle.
> The document doesn't talk about this at all, only mentioning in the security
> considerations that
> a change agent command should be authenticated. 
>   

Yes. But the protocols used between mobile nodes and home agents
require authentication and authorization of both sides to act in their
roles. This applies even with the new home agent.

Perhaps a statement about this for the security considerations
section would be appropriate.

> General Comments:
> - There are a bunch of places where something is defined/identified with no
> obvious explanation.
> For example, "section 7. Protocol Considerations", defines two timeout
> values. I wonder how they 
> came up with the values?
>   

Good question -- though I would expect any number to be
merely guidance that may get changed with implementation
and usage experience.

> - The IANA considerations may need a note to point that when the requested
> value is assigned, the 
> multiple TBDs in the text will need to change. Just as a reminder. 
>   

This is usually taken care of by the RFC Editor and IANA.
For ensuring that IANA actually does catch them, using
a string such as "TBD by IANA" is recommended, however.

Jari

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Jari Arkko <[email-masked]>
Date: Tue, 18 Sep 2007 20:37:16 +0300

Jari

---

From: Brian Haley <[email-masked]>
Date: Tue, 18 Sep 2007 17:09:13 -0400

Hi Jari, Patrick,

> section would be appropriate.

Sections 4.1 (sending) and 5.1 (receiving) do say that IPsec ESP is a 
MUST, is that not enough?  Maybe there's some confusion over whether 
this is the same SA used for Binding Updates/Acks?

> merely guidance that may get changed with implementation

James Kempf originally came up with those values, but it was back in 
2005, so I'm not sure of the reasoning.  I think the goal was to just 
allow for 3 retries.

-Brian

_______________________________________From [email-masked] Wed Sep 19 08:58:30 2007
Date: Tue, 18 Sep 2007 17:09:13 -0400
From: Brian Haley <[email-masked]>
Organization: Open Source and Linux Organization
To: Jari Arkko <[email-masked]>,
	patrick cain <[email-masked]>
Cc: [email-masked], [email-masked], [email-masked],
	[email-masked], [email-masked], [email-masked]
Subject: Re: security review of draft-ietf-mip6-ha-switch-03.txt

Hi Jari, Patrick,

> section would be appropriate.

Sections 4.1 (sending) and 5.1 (receiving) do say that IPsec ESP is a 
MUST, is that not enough?  Maybe there's some confusion over whether 
this is the same SA used for Binding Updates/Acks?

> merely guidance that may get changed with implementation

James Kempf originally came up with those values, but it was back in 
2005, so I'm not sure of the reasoning.  I think the goal was to just 
allow for 3 retries.

-Brian

---

From: Brian Haley <[email-masked]>
Date: Tue, 18 Sep 2007 17:09:13 -0400

Hi Jari, Patrick,

-Brian

_______________________________________ with esmtp (Exim 4.43) id 1IXirS-0004Cr-MS
	for [email-masked]; Tue, 18 Sep 2007 15:35:54 -0400
Date: Tue, 18 Sep 2007 21:35:24 +0200 (CEST)
From: Roger Jorgensen <[email-masked]>
To: Paul Vixie <[email-masked]>
Cc: 'IETF Discussion' <[email-masked]>
Subject: Re: ULA-C (Was: Re: IPv6 will never fly: ARIN continues to kill it)

On Tue, 18 Sep 2007, Paul Vixie wrote:
<snip>
> someone on ARIN PPML accused ULA-C (and therefore ULA-G) of being an "end run
> around PA/PI" by which they meant "a way to get the benefits of PI without
> qualifying for the costs imposed by PI on everyone else in the DFZ".  i
> realized in that moment, that ULA-G (and therefore ULA-C) is not an end run
> around PI space, it's an end run around the DFZ.  some day, the people who are
> then responsible for global address policy and global internet operations,
> will end the "tyranny of the core" by which we cripple all network owners in
> their available choices of address space, based solely on the tempermental
> fragility of the internet's core routing system.  but we appear not to be the
> generation who will make that leap.

I wouldn't be giving up that easy... still have time until march 2008 
:p (old ipv6-wg, now v6man-wg timeframe for deciding upton ula-c/g) :)

-- 

------------------------------
Roger Jorgensen              | - ROJO9-RIPE  - RJ85P-NORID
[email-masked]           | - IPv6 is The Key!
-------------------------------------------------------

________
Ietf mailing list
[email-masked]