Subject: FW: [mobile-ip] Unresolved issue #7: MH format

From: "Karen E Nielsen (TED)" <[email-masked]>
Date: Thu, 2 May 2002 16:20:20 +0200

Hi Mike,

(Sorry for duplicate, I forgot to cc mobileip list)

> Karen,
> 
> SA's are not looked up by source IP addresses.
> They only consider the SPI with the sole exception
> of multicast where it's SPI/DstAddr.

I know.  But the IPSEC processing should include matching 
the packet against the SA selectors. As long as the HoA appears in the
SA selector this implicitly provides integrity protection of the HoA.

> 
>  > > => same answer: to put the HA in the BU just makes things simpler
>  > > (and security things must be simple in order to be secure).   
>  > > Another argument is to make the BU self-sufficient ables 
> non-standard
>  > > way to transport the BU (piggy-backing into an AAA AVP 
> for instance).
>  > 
>  > In such special cases (ala piggy-backing into an AAA AVP 
> for instance).
>  > the HoA could be inserted as an option in the BU. This 
> should not be
>  > the (only) argument for mandating its presence in ALL BU's - Or..
> 
> I assume that you're concerned about bandwidth?
> See my question about the possibility of eliding
> the HAO.

Unless you want the IPSEC SA's (and SPD's) to be anchored on the CoA you would
need the HoA to be in one of the SA selector fields, or am I missing something ?

Karen

---

From: Michael Thomas <[email-masked]>
Date: Thu, 2 May 2002 07:47:57 -0700 (PDT)

> SA selector this implicitly provides integrity protection of the HoA.

Let me ask a very leading question: do you think
that IPsec security associations which are
divorced from the current topology and their
routing tags (eg, ip addresses) could be an
interesting property for mobility? I sure do.

I believe that all you need to do affect this is
to wildcard the SA ipsrc selectors on the
receiving end.

 > need the HoA to be in one of the SA selector fields, or am I missing something ?

Maybe. If the access control element on the
receiver is permissive (eg, a valid hash is
sufficient to let the packet through), it won't be
anchored *anywhere*. This seems like a very
interesting property to me.

	       Mike