Subject: [Mip6] MIPv6 BindingUpdate security

From: Ramin <[email-masked]>
Date: Mon, 29 Sep 2003 11:45:35 -0700

In the context of IKE for MIP BindingUpdates, the MIPv6 based spec. 
(ftp://ftp.rfc-editor.org/in-notes/internet-drafts/draft-ietf-mobileip-ipv6-24.txt) 
says:
"... the ID_IPV6_ADDR Identity Payload MUST NOT be used in IKEv1 phase 1."

Two questions:
- What is the rationale for this exclusion?
-  Is ID_IPV6_ADDR_SUBNET is legit type as identity payload in IKEv1 
phase 1?  That is, can we set the identity associated with the home 
address to the IPv6 subnet associated with the home address?  If yes, 
then wouldn't this type of ID violate the requirement that no MN should 
be able to send BindingUpdates for another MN?

Thank you,

-Ramin

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Tue, 30 Sep 2003 10:35:46 +0200

In your previous mail you wrote:

   Two questions:

=> because either you put the care-of address and you have no security
property on it (i.e., for instance it doesn't match an alternate subject
name in the certificate and IKE drops the session) or you put the home
address but the peer address is the care-of address (i.e., IKE can see
the peer address (the address IKE runs over) and the ID payload doesn't
match and drops the session).

   phase 1?

=> it should *not* be.

   That is, can we set the identity associated with the home 
   address to the IPv6 subnet associated with the home address?

=> we can't.

   If yes, 
   
=> first there is no such requirement, second the IKE is between the MN
and its HA (which is by definition a fixed router).

Regards

[email-masked]