Re: Router Security and FastRA (Re: [DNA] FastRA draft)

[Greg Daley <greg.daley@eng.monash.edu.au>]

Hi James,

James Kempf wrote:
> During the design team discussions in SEND, we discussed having the host
> preprovisioned with the new router's certificate so that there was no need
> for ADD when the host came up on the new router.
> 
> In the latest draft of CARD (draft-ietf-seamoby-card-protocol-07.txt), there
> is support for two additional CARD Request/Reply options: the Trusted Anchor
> option and the Router Certificate option. These allow a host to request the
> certification path for a handover candidate router from the existing access
> router, so the host doesn't have to do ADD on the new access router.

I think this ties in with Eunsoo's description of CARD and DNA
interactions.

Of course if we trusted the old router to provide accurate information
about candidate routers on adjacent links (not predicting which link
we'll arrive on, but that the routers in the CARD list are real
routers), we wouldn't necessarily need to undertake the certificate
chain computation immediately in every case.

That may be a bit dangerous to trust by itself but would give
us time to start using the router.  While using the router we
could corroborate the trust chain received from CARD messages
or receive one from the router itself after arrival on the link.

I'm not sure if this is a base DNA issue, a base CARD issue
or an interaction between the two.


> What Greg says about the crypto and other assorted signature processing on
> the RA is correct. It is an additional few milliseconds. The host has some
> additional work to construct the CGA, but that should be minimal as well,
> nothing compared to DAD or DHCP (naturally the host should use optiDAD, if
> available).

Of Course ;-)

Greg