Subject: RE: [Mip6] Seeking consensus on a MIP6 charter item

From: "Mohamed Khalil" <[email-masked]>
Date: Thu, 4 Sep 2003 16:28:23 -0500

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Thursday, September 04, 2003 3:05 PM
To: [email-masked]
Subject: [Mip6] Seeking consensus on a MIP6 charter item

Hello,

The following is a milestone identified in the current charter for Mobile
IPv6:

 o Mar 04 Submit alternate security mechanisms for HA-MN to IESG

However there is no corresponding text describing what this milestone really
means in the charter. My view of the above milestone is as
follows:
   Currently IPsec provides the means for authenticating a MN to the
   HA. This mandates the existence of an IPsec SA between the MN and
   HA. It is possible that an equivalent degree of security for the
   BU/BAck can be achieved by encapsulating an authenticator in a
   Binding data suboption. This basically falls back to the Mobile
   IPv4 model of authentication between MN-HA where the MN-HA auth
   extension is sufficient to create the binding in the HA. With this
   approach there is no reason to implement IPsec/IKE(v2) in a MIPv6
   MN, which I think is an overkill for basically doing authentication
   between two entities that are aware of each other. 

So the question is:
1. Should the Mobile IPv6 take on the work item mentioned in the
   milestone above? 

A: 
   Yes  [x]
   No   [ ]

Reason: 

Note that if there is consensus to work on this, the above text or some
equivalent would be added to the charter.

Please express your views on this by Sept 12th, 2003.

-Basavaraj

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Soliman Hesham <[email-masked]>
Date: Fri, 5 Sep 2003 10:55:18 -0400

> 
 > > Basically, I believe the bootstrap and dynamic addressing
 > > features are more important than simply replacing current
 > > protocol mechanism with another. Note that, as discussed in
 > > IETF-57, taking in account these two features could well mean
 > > replacing IPsec with something else; the choices really are
 > > something IKEv2 based or something "application" layer based -
 > > and I prefer the latter. But I think the charter should be
 > > written so that we require a mechanism to be designed such
 > > that these two features are provided, and leave more room
 > > for the specific solution to be developed.
 > 
 > Agreed.

=> Agreed. Agreed. ;)

Hesham

---

From: [email-masked]
Date: Fri, 5 Sep 2003 11:14:17 -0500

Hi Jari,

>>    Yes  [ ]
>I believe we need the work item, 

I guess I can take that as a Yes, with modifications required.

>but I am unsure about the text
>that was provided. Basically, at this time we lack two important
>functions from the HA-MN interface security. Here's what the old
>charter proposals said about them:
>
>    - A bootstrap mechanism for setting up security
>      associations between the MN and HA that would enable easier
>      deployment of Mobile IPv6.
>
>    - Support for the MN's changing addresses either because of
>      renumbering in its home network or because it periodically
>      changes addresses (perhaps via rfc3041)
>
>Its unclear to me whether your intent was to replace the work
>on these with the options work, or would both still be done?

Both of the above would be done. No intention of replacing this work.

>If its the latter, is that work independent of the alternative
>HA-MN security work or performed together?

This is a harder question :( 
First of all we really need to come to grips about the scope of the
bootstrapping work that is realistic. To do so, we plan on having a
problem statement I-D that explains the various scenarios and options
and then decide on the mechanism for bootstrapping. It is possible
that the bootstrapping solution will bootstrap either an IPsec SA
between the MN-HA or maybe enable exchange of session keys between the
two that are used for setting up the simpler [non-IPsec] SA. Hence it
depends on what the MN is capable of. The bootstrapping solution may
also be used for addressing the problem of MNs that change their HoA
because of renumbering or use of RFC3041 for HoA's. Here I believe an
existing SA (IPsec or otherwise) can be used to setup the new SA and
this is simpler than bootstrapping from NULL state. But the point is
that the alternative to IPsec SA bewteen MN-HA is also an option. 
So this work would be done independently of the above two work items. 

>protocol mechanism with another. 

Agreed. We know that the currently specified mechanism works. However
I also believe that if we really want to enable wide-scale
deployments, there is a need for a simpler solution. So while the
alternate solution is NOT critical for making Mobile IPv6 work, it
would be easier for implementing a nonIPsec based MIPv6 MN.

>Note that, as discussed in

Sure. We can work on the proper text that describes the work item more
accurately than what I scribbled earlier.

>--Jari

-Basavaraj