Subject: [MEXT] DSMIP6 (with TLS) MN software available for trialing

From: <[email-masked]>
Date: Mon, 19 Jul 2010 01:10:30 +0200

Hello,

We have completed an implementation of DSMIP6 with TLS based security
architecture as per I-D: draft-korhonen-mext-mip6-altsec-05.txt

The MN implementation is available for Nokia N900, Ubuntu 10 and Debian5
linux variants. We have also provisioned a DSMIP6 Home agent that you
can use for testing/trialing with. The HA provides an IPv6 and IPv4
home address and mobility.

Details of the installation and software download is available at:

http://dsmip6-tls.nokia.net

Give it a try and provide feedback.

-Basavaraj

---

From: [email-masked] (Arnaud Ebalard)
Date: Mon, 19 Jul 2010 21:55:50 +0200

Hi,

> architecture as per I-D: draft-korhonen-mext-mip6-altsec-05.txt

Honestly, I *must* be missing something. To make a parallel, to me, you
are trying to change a screwdriver into a hammer. And I still don't
understand why.

If you simply need a solution to encapsulate IPv4 or IPv6 packets over
UDP with an ESP header, why don't you simply use an IKE daemon with
support for MOBIKE? Or if you really want to use TLS for key
provisioning, some DTLS-based VPN?

Here, you combine UDP-encapsulated IPsec packet format for NAT-T (copy
and paste of ESP rfc, iirc), replace usual IKE for key establishment by a
*custom* protocol based on TLS and HTTP to provide key provisioning. There
is even a section (5.6.5) to provide a mapping between TLS ciphersuites
and the algs used to protect IPsec-piggybacked packets.

If you intend to push the draft as a WG item during the recharter
discussion in Maastricht, I think it would make sense to discuss those
points before on MEXT Mailing List. What do you think?

> linux variants.

I wanted to test it on Debian but http://dsmip6-tls.nokia.net/Deb5/ is
empty (it has "Software will be available on July 18th. Please check
back").

I took a quick look at the content of ubuntu package and I was wondering
if the patches against UMIP are available somewhere to take a look at
how it is implemented? Or should I ask the developers directly
(E. Panisset, B. Faria, F. Abnader and V. Pinto @indt.org.br)?

Cheers,

a+