Subject: Re: [mobile-ip] Interoperability for the Auth Suboption

From: Ryuji Wakikawa <[email-masked]>
Date: Sat, 08 Dec 2001 17:11:03 +0900

Hi Folks

We will give small notes for our implementations. It might not be so
valuable because the implementation is getting older. We are now
catching up the newer draft-15 (Not finished yet), but it seems not to
be so hard to implement the Authentication Sub Option as Vijay said in
his former mail about "Interoperability for the Auth Suboption".

Our current implementation is based on draft-ietf-mobileip-ipv6-13.txt
and has MN, CN and HA on FreeBSD KAME stack. Our implementation is
different from KAME-MIP6 implementation, we still keep working for our
original MIP6 implementation with original extensions at InternetCAR
project (http://www.sfc.wide.ad.jp/InternetCAR).

We tested MIP6 interoperability with many other implementations at
connectathon 2001.

Our BASE MIP6 features.
- Support multiple network interfaces for single home address, simultaneously. 
- Switching network interfaces (i.e. CoAs) depending on network environments and user's priority.
- IPsec (AH) Support 
- SA selectors
	As I posted mails to MIP6 ML before, SA selector was extended to
	handle the MIP6 SA for BU and BA. AHs insertion never
	becomes bottleneck when MIP6 piggy-back BU, because SFC-MIP6
	put AH only for the data with piggybacked BU and never put AH
	for the rest of data (without BU). Current implementation uses
	static SA (not running IKE).

Since we are implementing our original features into MIP6 and testing
the updated MIP6 now, we will announce and release newer MIP6 before long.
We are planning to participate in next connectathon2002 for newer MIP6
implementation (draft-15 base).

Please check the our MIP6 HP at http://neo.sfc.wide.ad.jp/~mip6/index.html
Unfortunately we can not go the next IETF, 
please contact us by mail ([email-masked]).

regards,
ryuji

At Wed, 28 Nov 2001 19:30:03 -0800,
Vijay Devarapalli wrote:
> 
> Hello,
> 
> At the ETSI IPv6 plugtest at Cannes last week, we managed to 
> achieve interoperability for the Authentication Sub Option.
> There were two independent implentations (one from HUT) and
> one from us (Nokia Research, Mt. View). There were also
> conformance tests from Ericsson Research, Hungary to test
> the Authentication Sub Option. The tests were successful.
> We used static security associations for the tests.
> 
> IMHO, It is very easy to implement. Compared to this AH
> checksum calculation is a mess.
> 
> The auth checksum was calculated over the following fields 
> (as specifed in draft 15).
> 
> For the Binding Update
> 
>     -  The IPv6 address of the destination of the packet, as seen by the
>        recipient
>     -  Care-of Address, in the Source IP Address of the IPv6 header
>     -  The Home Address of the mobile node, from the Home Address
>        destination option
>     -  Option Type of the Binding Update destination option
>     -  Option Length of the Binding Update destination option
>     -  All flags of the Binding Update destination option
>     -  Reserved Field of the Binding Update destination option
>     -  Sequence Number Field of the Binding Update
>     -  Lifetime of the Binding Update destination option
>     -  The entire data from all Binding Update Sub-Options (except the
>        Authentication Data suboption), if any others exist
>     -  The Type (i.e., the 8-bit value 0x04) and the Length of the
>        Authentication Data Sub-Option
>     -  Security Parameters Index (SPI) of the Authentication Data
>        Sub-Option
> 
> 
> For the Binding Acknowledgement
> 
>     -  The IPv6 address of the destination of the packet, as seen by the
>        recipient
>     -  The Home Address of the sender
>     -  Option Type of the Binding Acknowledgement destination option
>     -  Option Length of the Binding Acknowledgement
>     -  Status of the Binding Acknowledgement
>     -  Sequence Number field of the Binding Acknowledgement
>     -  Lifetime field of the Binding Acknowledgement destination option
>     -  Refresh field of the Binding Acknowledgement destination option
>     -  The entire data from all Binding Acknowledgement Sub-Options
>        (except the Authentication Data suboption), if any others exist
>     -  The Type (i.e., the 8-bit value 0x04) and the Length of the
>        Authentication Data Sub-Option
>     -  Security Parameters Index (SPI) of the Authentication Data
>        Sub-Option
> 
> 
> regards
> Vijay