Subject: [MEXT] Next steps in the IPsec MIP6 topic

From: marcelo bagnulo braun <[email-masked]>
Date: Thu, 26 Mar 2009 22:11:32 +0100

Hi,

After the feedback we got in the last two IETF meetings, it is
clear that further actions are needed in the MIP6 security topic.

The question is whether we IPsec is the right security mechanism
for  MIP6 and  what should we do about this.

The proposed way forward with this is that we need 3 types of
documents to understand the problem.

First, we need a very clear, technical description, containing
all the details of what are the problems with IPsec in MIP6.
This document could contain, at least, the following items:
- It should cover both MIP6 and DSMIP.
- It should describe for each of them which are the specific
problems that are considered so harmful.
- It should describe for each of them what are the differences
with an of-the-shelf IPsec implementation.

Second, we need a very clear, detailed set of requirements
for a new security mechanism for MIP6.

Third, detailed description of alternative security solutions.
We need enough detail to understand the complexity of these
solutions and whether they provide enough security and
functionality.

These documents are not expected to be produced in sequence, but
rather in parallel. By this, i mean that i would expect that
we need all of them to understand the problem.

If there is enough interest (i.e. discussion and documents) we
can discuss this in the next meeting.

Comments?

---

From: [email-masked] (Arnaud Ebalard)
Date: Thu, 26 Mar 2009 23:24:24 +0100

Hi,

marcelo bagnulo braun <[email-masked]> writes:

> [snip]

First question which should be answered IMHO is: What are the
hypothesis for the environments in which MIPv6 MNs may move and
HA may be deployed? This will provide specific security needs.

For instance:

- a MN from a corporate/home network in the IPv6 internet
- a MN in a mobile operator network or another close domain

have different needs security wise.

Those who see issues in the use of IPsec/IKE as a security solution
for MIPv6 may just have different requirements in their networks and
may consider IPsec too complicated or too powerful for their needs.

Cheers,

a+

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Thu, 26 Mar 2009 17:42:20 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> marcelo bagnulo braun
> Sent: Thursday, March 26, 2009 2:12 PM
> To: mext; Julien Laganier; Jari Arkko; Ralph Droms; Pasi Eronen
> Subject: [MEXT] Next steps in the IPsec MIP6 topic
> 
> Hi,
> 

For the first document, I'd like to see a description of what other than the dual NAT-traversal for DSMIP6 are issues and whether defining the PF_KEY interface will remove those issues. 

Thanks,
Vidya

> _______________________________________________
> MEXT mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/mext