Subject: [mobile-ip] Updated SAPv2

From: "Haseeb Akhtar" <[email-masked]>
Date: Mon, 30 Apr 2001 12:23:32 -0500

Hello all,

We have sent an updated version of the SAPv2 (Security Association
establishment Protocol) to the IETF editor. Following is the link for
accessing the document while it shows up in the IETF database. 

The introduction is attached as well.

We would appreciate your feedback.

Regards,

Mohamed Khalil
Haseeb Akhtar
Emad Qaddoura

----------------------------------------------------------------------------
----------------

ftp://standards.nortelnetworks.com/mobile-ip/docs/draft-mkhalil-mobileip-ipv
6-sap-02.txt

1.0 Introduction

   This draft outlines a  protocol that allows a dynamic establishment
   of Security Association (SA) between two nodes: the MN and the CN.
   The proposed protocol doesn't depend on its operation on a global or
   centralized PKI (Public Key Infrastructure) or KDC (Key Distribution
   Center). The existing Mobile IPv6 [2] messages are used to piggyback
   the security extensions required to negotiate the SA between the MN
   and the CN. This results in a usage optimization for the RF
   interface.

   The whole idea behind this protocol is to protect the messages
   between the MN and the CN (e.g. Binding Update, Binding
   Acknowledgement etc.). If the attacker resides on the link between
   the MN and the CN, the attacker then has no interest in intercepting
   and/or changing the messages (e.g. Binding Warning, Binding Update
   and Binding Acknowledgement) that are exchanged (since the attacker
   already has access to the traffic). If the attacker is off the link,
   then the attacker is interested in intercepting the messages (e.g.
   Binding Update) in order to direct the CN's traffic to the attacker.
   An assumption is made here that the attacker who is on the link is
   really not applicable to this problem.

   The security features provided by the proposed protocol are discussed
   in details in section 4.0, which include DoS protection, replay
   protection, non-repudiation, and message integrity.