Subject: [mobile-ip] MobileIPv6 and IKE.

From: Alain Ritoux <[email-masked]>
Date: Thu, 08 Mar 2001 11:08:26 +0100

Hi everybody,
(the first sending seemed to  get a nasty end : my excuses if you get
this msg twice).

I'm interested in securing the MobileIPv6 exchanges, with the mandatory
IPsec, and hence with IKE. The BU sent by the MN to its HA must ne
authenticated, henc need an SA, but the HA can't speak to the MN untill
the BU is accepted. How can IKE take place in such conditions ?
Is there a solution to this chicken-and-egg pb ?
If yes, is it a standard ? going to be one ?
Moreover while reading variuos RFC and drafts (mobility support for
IPv6, Destination option header clarification, IPv6 soecs ..) I'm
getting a little bit confused about the IPv6 extension headers order, or
the real place some destination option may/should/must? take place wrt
various destination options headers? Is there also something stbale ?
standard ? for this.
btw I'm interested in any good material/references about those subjects.

If you feel, some subject should be discussed elswhere (IPsec? IPng ?
...), let me knwon.

Best regards.
Alain.

---

From: Francis Dupont <[email-masked]>
Date: Fri, 09 Mar 2001 10:16:41 +0100

=> I assume you have already read Mohan Parthasarathy's answer
(and of course the end of the section 10.2 of the I-D 13).
I believe we should add some conditions to the mandatory usage of
the care-of address because if this is needed for the mobile node
first home registration this can be expensive (and is no more needed)
in other cases (the price is the authorization problem).

=> home address and tunnel encapsulation limit options should be in
a destination option header just after the routing header (if any) and
just before the fragmentation header (if any). Binding update, acknowledge
and request options must be after IPsec headers (if any but AH is mandatory
for the first two options) and before the upper layer header.
There is no other defined useful destination option.

=> IPng WG. You should look at IPng WG minutes of the last meeting
but from here playground.sun.com/www.connectathon.org seems down...

Regards

[email-masked]