Subject: [Mip6] Before BU..

From: Warodom Werapun <[email-masked]>
Date: Mon, 27 Sep 2004 16:23:51 +0700

Before MIPv6 process Binding update, I saw that there are RR, IPsec 
, IKE.
I heard that IPsec make RR securely (protect man-in-the middle all paths).
And before we use IPsec, we need to setup SA via IKE.  
    So, if we used IKE (may be SKIP (diffie-cert) ) to generate Kbu (Kbm)
and take out IPsec and RR. I think, it may decrease packet delay time 
significantly, isn't it?

-- 
Warodom  Werapun
PGP:  http://plex.coe.psu.ac.th/myPGP.txt

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Francis Dupont <[email-masked]>
Date: Mon, 27 Sep 2004 11:56:37 +0200

In your previous mail you wrote:

=> do you speak about the MN-HA case, the MN-CN case or both?
Currently:
 - IPsec is mandatory and IKE recommended in the MN-HA case
 - RR is mandatory in the MN-CN case but there are some proposals
   for stronger but dedicated schemes in this case:
   * preconfigured Kbm (draft-ietf-mip6-precfgKbm-00.txt)
   * IPsec (draft-dupont-mipv6-cn-ipsec-01.txt)
   * CGA (draft-haddad-mip6-cga-omipv6-02.txt)
   ...

=> yes, RR security relies on IPsec between MN-HA.

=> currently one has the choice between manual keying, automatic keying
using IKE and automatic keying using something else than IKE.
Obviously the last solution is dedicated, i.e., it relies on a
preagreement but this constraint is not a real problem as there should
be some kind of preagreements in any case.

=> if I understand well you propose to create a DOI for IKE in order
to build directly a Kbm? I can't see major advantages vs preconf Kbm
or IPsec...

Thanks

[email-masked]