1 Alternative (Future) Proposals for MIPv6 Security MIP6 BOF/WG IETF-57 Jari Arkko, Ericsson Research NomadicLab Charlie Perkins, Nokia Research Center

2 Background Improvements over RR New functions for HA - MN communications Michael Thomas’ non-SPD based authorization model HA-MN IKE-variant feedback Other developments in IETF - IKEv2

3 Improvements on RR Several proposed mechanisms: –Shared secret –CGA It seems that most people are after speed –Example: CGA could eliminate most or all home address tests –A hard problem is trying to optimize care-of tests Suggestion: –Optional mechanisms allowed in addition to RR

4 New Functions Addressing freedom –Previously unknown home addresses (3041) –Previously unknown home agents –Currently, we assume a tight binding to addresses Dynamic assignment of home agents –Reduces RTT through the home agent –Hides mobile node’s topological location –Need to solve AAA interaction, secure anycast, and authorization issues Suggestion: –Work on a specification for these functions

5 HA-MN IKE-Variant Feedback SSH has a IKE-based HA-MN security implementation But, it does things in a slightly different way... –IPsec policies and SAs use only care-of addresses –No authorization policy needed for IKE phase 2 establishment –Additional HAO checks are associated with SAs/credentials Properties: –Easy for BITS, tough on manual keying –Performs both SPD&selector checks and HAO checks –On-the-wire format the same for packets, only difference in IKE –Reminds us of the scheme Michael Thomas proposed earlier Suggestion –Produce a future “extended” specification (perhaps IKEv2 version of the current specification), and take this in account

6 Additional IKEv2 Issues Mobility/roaming/multi-homing/SCTP function for IKEv2? A method to move SAs to a new address In MIPv6, move IKEv2 first, then send a BU Not a part of IKEv2 RFC, design somewhat open –Different signaling approaches proposed –Scope - is multi-homing included? Suggestion: –Produce a future specification for IKEv2 roaming –Ensure that it suits MIPv6 needs

7 Possible Future Work Items Improved RR protocols IKEv2 roaming -- work with the IPsec WG (or new WG) A new, more powerful specification for MN - HA security –Dynamic home addresses –Dynamic home agents –Using IKEv2 features Strawman designs for the above: –“Application” layer design –IKEv2 design