Subject: Re: [Seamoby] Issue 2: CTAR Response Needed

From: Julien Bournelle <[email-masked]>
Date: Fri, 27 Jun 2003 16:16:43 +0200

Hi,

please see my comment inline,

On Thu, Jun 26, 2003 at 02:24:48PM -0700, Charles E. Perkins wrote:
> - For security, I think that the answer is still
>   not clear, and it might depend on the reason why
>   the security context could not be transferred.
>   But I did not feel comfortable saying that we
>   should automatically inform prospective security
>   clients that their credentials are invalid.

If we think of IPsec SA, I think that there are some cases where it
could be necessay to give information to the MN before the handover.
Let consider this scenario:

  MN ------------ pAR
		   |
		   |
		  nAR

If MN shares an IPsec SA with pAR and wants to perform an handover with
nAR, it may be possible to send the IPsec SA information from pAR to
nAR. However some collision may occur (e.g. SPI). In this case, the nAR
could give to the MN via pAR the new SPI to use.

> 
> Perhaps the right answer is that, once a context is
> clearly identified as needed a CTAR response, at that
> time we could create the protocol message.  Then, it
> would be a matter for the feature profile to specify
> whether the particular context type needed to allow
> for CTAR response or not.
> 
> If that time arrives, then someone will have to make
> the further determination about whether only negative
> responses are needed, or whether responses are needed
> even for positive results.

I'm ok but does this mean that in this case we have only a binary
response ? Maybe some context would benefit of the ability to embed
configuration data for MN.

-- 
[email-masked]

_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby