Subject: RE: [Mip6] Bootstrapping on the home link

From: "Soliman, Hesham" <[email-masked]>
Date: Mon, 24 Apr 2006 11:51:25 -0700

> > => I wasn't referring to the amount of information stored, I was 
 > > talking about the type of information.
 > 
 > So for you the type of preconfigured information is cert, then it's
 > better than if the type of information is SA key plus home prefix?

=> yes. But i'm not saying DHAAD should be deprecated, you can choose
in your own deployment. 

 > >> how do you update certs on the MN?
 > > 
 > > => You don't need to.
 > 
 > If one doesn't change it, and the cert is tied to the FQDN, and the 
 > respective company gets sold to some other company, and the 
 > domain name 
 > changes, then the mobile won't be able to authenticate to 
 > its HA unless 
 > one updates the cert on MN, no?

=> Yes but this is not specific to MIP6, it's a general issue
for cert management.  

Hesham

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 24 Apr 2006 21:12:25 +0200

> => yes. But i'm not saying DHAAD should be deprecated, you can choose

That's why I'm suggesting to title this draft "DNS-based MIP6 MN
bootstrapping in split scenario" instead of the current all-covering
"MIP6 bootstrapping in split scenario".  It leaves the place for other
drafts describing other deployments with "DHAAD-based MIP6 MN
bootstrapping in split scenario".  Would you agree?

>>  respective company gets sold to some other company, and the domain
>> name changes, then the mobile won't be able to authenticate to its
>> HA unless one updates the cert on MN, no?
> 
> => Yes but this is not specific to MIP6, it's a general issue for
> cert management.

Right, it's a general issue for cert management; it's still an issue and
the ephemerality of certs is the same as that of the pre-configured
prefixes.  Would you agree?

Alex