Subject: RE: [Mip6] Comments on draft-ietf-mip6-bootstrapping-split-01.txt

From: Gerardo Giaretta <[email-masked]>
Date: Thu, 01 Dec 2005 12:18:21 +0100

Hi Kilian,

back for technical issues not responded by Vijay.

> 
> Technical
> =========
> 
> page 7 (end of page): 
> ---------------------
> - "If, instead, a PKI is used, the MN and HA exchange 
> certificates and 
> there is no AAA server involved. This is conceptually similar to 
> Figure 1, since the MSP == MSA, except the HA may require a 
> certificate revocation list check (CRL check) with the Certificate 
> Authority (CA). " 
> 
> 	The text says that if PKI is used, the HA may require a CRL.
> Doesn't the MN potentially require a CRL as well in this case? (e.g.,
> for the rare case that HA is compromised). 
> 

I guess you are right. James, do you agree?

> 
> - " Please see other drafts that contain detailed 
> mechanisms for localized home agent assignment, such as [15], "
> 
> 	There is no such section in [15] yet
> 

section 3.2.2 of [15]. Isn'it the right section we are referring?

--Gerardo

Gruppo Telecom Italia - Direzione e coordinamento di Telecom Italia S.p.A.

====================================================================
CONFIDENTIALITY NOTICE
This message and its attachments are addressed solely to the persons
above and may contain confidential information. If you have received
the message in error, be informed that any use of the content hereof
is prohibited. Please return it immediately to the sender and delete
the message. Should you have any questions, please send an e_mail to 
[email-masked]. Thank you
====================================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "James Kempf" <[email-masked]>
Date: Thu, 1 Dec 2005 09:06:39 -0800

Actually, the MN potentially requires a CRL check even if EAP/AAA is used, 
since currently IKEv2 requires that the responder be certified and does not 
allow AAA to be used for authentication of the responder. I suppose this 
should be explicitly stated in the discussion, since the text does discuss 
other aspects of the initiator/responder transaction that are part of the 
IKEv2 spec.

            jak

----- Original Message ----- 
From: "Gerardo Giaretta" <[email-masked]>
To: "Kilian Weniger" <[email-masked]>
Cc: <[email-masked]>; "James Kempf" <[email-masked]>
Sent: Thursday, December 01, 2005 3:18 AM
Subject: RE: [Mip6] Comments on draft-ietf-mip6-bootstrapping-split-01.txt

Hi Kilian,

--Gerardo