Subject: [Fwd: Re: [mobile-ip] About authorization and security policies]

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 20 Dec 2001 15:44:23 -0800

here is an old mail from Jari Arkko. this is tells me
that it is not too difficult making Authentication 
sub option work with IKE. and we have also proved
that it is implementable and interoperable.

regards
Vijay

-------- Original Message --------
Subject: Re: [mobile-ip] About authorization and security policies
Date: Tue, 14 Aug 2001 09:39:04 +0300
From: Jari Arkko <[email-masked]>
Reply-To: [email-masked]
Organization: None
To: [email-masked]
References:
<200108140252.f7E2qLn00537@[email-masked]>

Dan Harkins wrote:

>> If we want to use IKE with -14 authentication, we basically need
>> a new DOI (or extension to the Internet DOI), specifying how 
>> authentication data for -14 BU authentication is created.
> 
> Why? The DOI does not specify how authentication data is created.
> That is done in AH (2402) or ESP (2406) RFC. 

The use of IKE with -14 authentication doesn't
require a full DoI. It requires an _extension_
to the current DoI. Such extensions are regurlarly
done to add algorithms. This extension would be
a bit bigger perhaps -- adding a new protocol --
but still basically a number allocation in some
defined place.

However, one drawback of using IKE with -14
authentication is that other key management
protocols would have to be updated also. For
instance, the possible Son-of-IKE protocol
would also be affected. (It may be that
all these protocols share the same DoI and
algorithm numbers, but I'm not sure if this
would be the case always.)

Jari