Subject: RE: [netlmm] pmip6-ipv4-support-01

From: "Alper Yegin" <[email-masked]>
Date: Mon, 23 Jul 2007 14:08:10 -0500

During our lunch chat, Vijay pointed out that RFC3775 mandated use of IPsec,
yet we also allow use of RFC4285 for MIPv6.

5.1.  Binding Updates to Home Agents

   The mobile node and the home agent MUST use an IPsec security
   association to protect the integrity and authenticity of the Binding
   Updates and Acknowledgements.

Aren't we violating RFC 3775 by "NOT using" IPsec when we use RFC4285? 

Alper 

> -----Original Message-----
> From: Alper Yegin [mailto:[email-masked]]
> Sent: Monday, July 23, 2007 10:42 AM
> To: 'Vijay Devarapalli'
> Cc: [email-masked]'
> Subject: RE: [netlmm] pmip6-ipv4-support-01
> 
> Vijay,
> 
> I think it is "overly constraining" to *mandate* **use** of any specific
> security mechanism for PMIPv6. Why would you want to shut down any
> alternatives, that may be available today or come along in the future?
> 
> This is all about protocol modularity.
> 
> As for the security model compatibility, consider how PMIPv4 is secured
> using MIPv4 extensions.
> 
> Alper
> 
> > -----Original Message-----
> > From: Vijay Devarapalli [mailto:[email-masked]]
> > Sent: Sunday, July 22, 2007 10:10 PM
> > To: Alper Yegin
> > Cc: [email-masked]
> > Subject: Re: [netlmm] pmip6-ipv4-support-01
> >
> > Alper Yegin wrote:
> > >>> My point is, can anyone claim "rfc 4285 does not work with PMIPv6"?
> > >> 4285 only defines MN-HA authentication option today. So you would
> > >> need to extend it before it can be used between the MAG and the LMA.
> > >> So one could say RFC 4285 would not work with PMIPv6.
> > >
> > > Are you just picking on the terminology here (like it is called "MAG"
> > not
> > > "MN"), or something else? If former, RFC3776 has "MN" and "HA" written
> > all
> > > over it.
> >
> > We have defined in detail how IPsec is used between the MAG and the
> > LMA in draft-ietf-netlmm-proxymip6-01.txt. This includes defining
> > new SPD and PAD entries. See section 4. We didn't try to hack RFC
> > 3776 or 4877 to make them work for PMIPv6.
> >
> > For using RFC 4285, you would need to define a new sub-type to say
> > MAG-HA authentication option. Currently it only defines a MN-HA
> > authentication option. From RFC 4285
> >
> >        Subtype:
> >
> >           A number assigned to identify the entity and/or mechanism to
> be
> >           used to authenticate the message.
> >
> > >> I'm not
> > >>> arguing about the better suitability, or historical motivations
> behind
> > >> the
> > >>> protocol.
> > >> Well, there has to be a reason for you wanting to use RFC 4285
> > >> between the MAG and the LMA. If you can explain that, we could
> > >> probably have a more meaningful discussion. IMO, IPsec makes more
> > >> sense between the MAG and the LMA.
> > >
> > > Please see my response to Ryuji.
> >
> > You said you wanted to use the same protocol for MIPv6 and PMIPv6.
> > But MIPv6 and PMIPv6 have different security models.
> >
> > Vijay

_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm