Subject: [mobile-ip] RFC 2002 SPI bug

From: [email-masked]
Date: Tue, 13 Nov 2001 11:33:00 -0600

Perhaps my first post was not clear, let me be more direct:

Given the SPI issue in 2002, is one in compliance with 2002 if
the SPI is or is not included in the hash?

Thanks,
Mike

---------------------- Forwarded by Mike Borella/MW/US/3Com on 11/13/2001
11:34 AM ---------------------------

Mike Borella/MW/US/3Com
11/12/2001 05:56 PM

Sent by:  Mike Borella  -  Manager, ][CommWorks Wireless Systems and
      Architecture

To:   [email-masked]
cc:
Subject:  RFC 2002 SPI bug

Hello,

I was looking through the mailing list archives and I can't quite
find what I'm looking for.  Apparently section 3.5.1 of 2002 does
not include the SPI in the authentication hash, but it is common
practice to include the SPI.  I've gathered this from reading the
message in this link:

http://playground.sun.com/pub/mobile-ip/WG-archive/frm02527.html

(Apologies if I'm not reading this correctly...I've made a couple of
assumptions here...)

However, I have not found a reason as to why such a change has
been made.  Can anyone tell me:

- Why the SPI should be in the hash
- If there are any known issues if the SPI does not appear in the hash

Thanks,
Mike

---

From: "Henrik Levkowetz" <[email-masked]>
Date: Tue, 13 Nov 2001 21:42:01 +0100

Hello folks,

	As was briefly presented at the very end of one of the London Mobile-IP sessions, the widespread use of NATs is found to be a
noticeable problem when deploying MIPv4. Before the London IETF,
3 different drafts were posted which described 2 different aspects of
this problem, and proposed some solutions.

	The authors of the two drafts which touched upon simple NAT/NAPT
traversal have, with lots of good input from other people in the
IETF MIP community, produced a new! fresh! consolidated! draft which
is offered to this list and the working group for consideration:

http://www.ietf.org/internet-drafts/draft-levkowetz-vaarala-mobileip-nat-traversal-00.txt

	We would really appreciate you taking the time to read through
and comment on this draft -- although not maybe as interesting as
BETH or route optimization for MIP :-), this draft is attempting a
solution to a noticeable roadblock on the road to wide deployment of
MIPv4.

	A second draft, from two other authors involved in the discussions, will consider another aspect of the problem: deployment
involving
firewalls and VPNs. This second draft uses the mechanisms presented
in the first draft where appropriate. It will be submitted later.

	Hoping for some good feedback on the NAT/NAPT traversal draft,

	Best regards,

		Henrik

------------------------------------------------------------------------
Henrik Levkowetz +46708321608 [email-masked] www.ipunplugged.com
------------------------------------------------------------------------

  Never test the depth of the water with both feet.