Subject: [Mip6] concerns about draft-devarapalli-mip6-ikev1-bootstrap-00.txt

From: Francis Dupont <[email-masked]>
Date: Sat, 22 Oct 2005 18:09:15 +0200

I maintain my previous concerns about MODECFG and XAUTH. Now I've read
the whole document and I have some other concerns:
 - there are some normative references to documents which timed out
   many years ago
 - there should be security considerations about the well known
   essential insecurity of XAUTH (*)
 - I am not convinced DHCPv6 can be used over IKE as described:
   DHCPv6 is designed to run between the client and the first relay/server
   over a link using multicast and link-local addresses. So it runs without
   problem over L2TP/PPP between a client and a NAS. Here we have a tunnel
   mode IPsec which is pretty different than a real tunnel interface.
So sections 3.1, 3.2 (HoA config) and 4 (SA setup) are at least questionable.
The remaining spec is the section 5 (DNS update) which is already in
a bootstrapping document... So I am sorry but IMHO there is nothing
really useful today in the document.

Regards

[email-masked]

(*): If someone knows Jose Puthenkulam, ask him to refresh its I-D.

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6