Subject: Re: [Mip6] I-D ACTION:draft-ietf-mip6-cn-ipsec-04.txt

From: Behcet Sarikaya <[email-masked]>
Date: Thu, 1 Mar 2007 13:38:33 -0800 (PST)

Hi Francis,
  
Maybe it is too late to have any technical comments on this draft 
However, can I have the following editorial comments?

In Sec. 7, you said:
the ingress filtering blocks topologically incorrect Care-of
      Addresses (because there are source addresses too), 

s/there/they?

In Sec. 4, you said:
By just setting up an IPsec SA with the CN, the MN is able to send
   packets directly to the CN, i.e., triangular routing is enabled.
s/triangular routing/route optimization/?

Wait, there is one more:
In Sec. 9:
When the Home Address is bound to a public key, for instance when the
   Home Address is a Cryptographically Generated Addresses [RFC3972],
s/Addresses/Address/

Regards,

--behcet
----- Original Message ----
From: "[email-masked]" <[email-masked]>
To: [email-masked]
Cc: [email-masked]
Sent: Thursday, March 1, 2007 2:50:03 PM
Subject: [Mip6] I-D ACTION:draft-ietf-mip6-cn-ipsec-04.txt

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.
This draft is a work item of the Mobility for IPv6 Working Group of the IETF.

    Title        : Using IPsec between Mobile and Correspondent IPv6 Nodes
    Author(s)    : F. Dupont, J. Combes
    Filename    : draft-ietf-mip6-cn-ipsec-04.txt
    Pages        : 9
    Date        : 2007-3-1
    
Mobile IPv6 uses IPsec to protect signaling between the Mobile Node
   and the Home Agent.  This document defines how IPsec can be used
   between the Mobile Node and Correspondent Nodes for Home Address
   Option validation (aka. triangular routing) and protection of
   mobility signaling for Route Optimization.  The configuration details
   for IPsec and IKE are also provided.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-mip6-cn-ipsec-04.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of 
the message. 
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 
username "anonymous" and a password of your e-mail address. After 
logging in, type "cd internet-drafts" and then 
"get draft-ietf-mip6-cn-ipsec-04.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
    [email-masked].
In the body type:
    "FILE /internet-drafts/draft-ietf-mip6-cn-ipsec-04.txt".
    
NOTE:    The mail server at ietf.org can return the document in
    MIME-encoded form by using the "mpack" utility.  To use this
    feature, insert the command "ENCODING mime" before the "FILE"
    command.  To decode the response(s), you will need "munpack" or
    a MIME-compliant mail reader.  Different MIME-compliant mail readers
    exhibit different behavior, especially when dealing with
    "multipart" MIME messages (i.e. documents which have been split
    up into multiple messages), so check your local documentation on
    how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "Jean-Michel Combes" <[email-masked]>
Date: Fri, 2 Mar 2007 14:22:03 +0100

Hi Behcet,

>       Addresses (because there are source addresses too),

<JMC>
 Yes. Thanks.
<JMC>

> s/triangular routing/route optimization/?

<JMC>
No, the term triangular routing is correct :)
The reason is that _all_ packets the MN sends to the CN are secured with
IPsec. The CN knows so the MN is allowed to use the HoA and so this is not a
reflection attack.
<JMC>

>    Home Address is a Cryptographically Generated Addresses [RFC3972],

<JMC>
Agree. Thanks.
<JMC>

Best regards.

JMC.

Regards,

---

From: Francis Dupont <[email-masked]>
Date: Fri, 02 Mar 2007 17:26:29 +0100

In your previous mail you wrote:

=> it is never too late for improvements...

=> caught.

   In Sec. 4, you said:

=> no, it is only the MN->CN way so it is only triangular routing...

Thanks

[email-masked]