Subject: RE: [mobile-ip] Unresolved issue #7: MH format

From: "Karen E Nielsen (TED)" <[email-masked]>
Date: Thu, 2 May 2002 20:59:27 +0200

Hi Francis,

>  In your previous mail you wrote:
> 
>    > => this is *not* true: if the IPsec transform is not AH, the 
>    > HAO is not
>    > covered by the integrity check and it is authenticated 
> only by the SA
>    > lookup (i.e. not by the crypto, only by (reusing Mike 
> Thomas' words)
>    > an access-list mechanism).
>    
>    An why is it that this (SA lookup) isn't good enough ? 
>    
> => an access-list like check is far weaker than a 
> crypto-based integrity
> and authentication check, and IMHO too weak (i.e. not good enough).
> 

If you're saying that not all IPSEC implementations perform the 
(in 2401 mandated) SA selector matching and that
such IPSEC implementations should be allowed,
i.e. do not "stretch" IPSEC to much, then I agree that
crypto is needed. 

However, the fact remains that if the SA selector contains the HoA 
(which I suppose it should unless you want the 
SA to be shared between the receiving node and a range of 
(or all) hosts from which it is accepting BU's) 
and if the SA selector match can be relied on to be performed,
then the HoA IS integrity protected and crypto doesn't buy you any extras. 

BR,
Karen

---

From: Francis Dupont <[email-masked]>
Date: Fri, 03 May 2002 09:52:43 +0200

If you're saying that not all IPSEC implementations perform the 
   (in 2401 mandated) SA selector matching

=> SADB (and SPD) selectors are not always addresses.

   and that such IPSEC implementations should be allowed,
   i.e. do not "stretch" IPSEC to much, then I agree that
   crypto is needed. 
   
=> you have Mike Thomas' messages about this...

=> same answer... Your argument seems that firewalls and IPsec give the
same level of security and I (and many others) disagree.
AH will be deprecated in IPsec v3 (cf last IETF meeting), HAO is not
always present, etc, so I believe to make the HoA optional is not
a good choice (i.e. it is too soon for space optimization of mobility
signaling).

Regards

[email-masked]