Subject: RE: [mobile-ip] Security on Local "Home Agent" Functionality?

From: [email-masked]
Date: Fri, 15 Mar 2002 13:20:09 -0600

James Kempf [[email-masked]] wrote:

>
>However, the AR is in the foreign network. Revealing
>a global address there is an entirely different matter.
>Do we expect the MN to have an IPsec SA with
>every AR in the foreign network that implements
>on-link "home agent" functionality?

The DT recommends that "on-link" or temporary home agent (previous
AR) should process BUs from MNs only if it has an SA with it. The same
security requirements that are applicable for the normal MN-HA BUs are
aplicable to the temporary HA. 

The base MIPv6 specification hence will not permit MNs to send BUs to
previous ARs (temporary HA). However with FMIPv6 or other future
extensions we could specify how an MN can establish an SA with its AR
which can be for the specific purpose of having the AR act as a temp
HA. 

>            jak

-Basavaraj

---

From: "James Kempf" <[email-masked]>
Date: Fri, 15 Mar 2002 12:00:46 -0800

Hi Raj,

> aplicable to the temporary HA.

OK, I presume this will be stated in the security section of the MIPv6
draft,
that all HAs have the same requirements with respect to security?

> which can be for the specific purpose of having the AR act as a temp

Probably a little premature for this, but it might be necessary to add
some
text to the FMIPv6 spec to cover this case.Alternatively, perhaps there
is a
way to achieve what FMIPv6 needs without requiring the MN to communicate
beyond the routers on its current link.

            jak