Subject: RE: [seamoby] Single sentence problem statements

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 6 Feb 2001 11:15:57 +0100

>  > 	=> We most certainly do not want the handover to require a new IKE
>  > 	exchange and I don't understand how it would. I'm surprised these 
>  > 	concerns were raised. The concerns are not valid because MIPv6 
>  > 	mandates that the SA be established based on the Home address. 
>  > 	Hence, when moving no new SAs are required to update the HA and 
>  > 	CNs. As for updating the previous AR, yes an SA is required but
> there 
>  > 	are two solutions we investigated in MIP to solve this :
>  > 
>  > 	1. If you're using a flat mobility management model (no MAP)
>  > 	   then we were counting on SEAMOBY to transfer the SA
>  > 	   from the old AR to the new one. I think this is a very valid
>  > 	   solution. 
> 
> I believe that *any* discussion of the ability to
> transfer security context needs to be placed under
> a giant microscope and evaluated with a jaundiced
> eye. Transfering secret keys and security context
> is not something that should be taken lightly.
> I'm particularly vexed by the notion of
> transfering IPsec SA's: it strikes me as a highly
> dubious thing to do.
> 
	=> I'm sure tha the CT team will have access to the 
	necessary microscopes. So let's not predict what 
	the outcome will be.

> This is one area that I'd far prefer that if there
> is a way to get this all to work in the usual way
> (read: just recreating the SA), it should be 
> considered.
> 
	=> Not if you're moving fast within small subnets and 
	trying to save spectrum !

	You ignored point #2 because you agree with it ?

>  > 	As for IKE and whether it's too heavy, spectrum inefficient ..etc
>  > 	please have a look at draft-soliman-mobileip-routeopt--mipv6-00.txt 
>  > 	which proposes an alternative.
> 
> This is _simpler_ than IKE? Yikes. Also: it looks
> like you've managed to recreate the cross realm
> Kerberos wheel with about 15 years less deployment
> experience.
> 
	=> So Sending one message from the MN to establish an 
	SA is more complex than doing an IKE exchange in your opinion ?
	Apart from suffering the "Yikes", is there a technical argument
	against the draft ?
	Really, we'd like to get some technical feedback.

	Hesham

---

From: Michael Thomas <[email-masked]>
Date: Wed, 7 Feb 2001 16:44:01 -0800 (PST)

> 	trying to save spectrum !

   Hopefully it doesn't come down to this kind of
   tradeoff.
 
 > 	You ignored point #2 because you agree with it ?

   No, it's because I generally ignore all of this krufty 
   back to back tunnel stuff since it's just PSTN access
   tandems in IP clothes.

 > 	Really, we'd like to get some technical feedback.

    Well, first of all the notion that CN has any
    relationship with a AAA of any sort is highly
    suspect, IMO. Whose AAA is my apache web
    server supposed to be contacting?

    Second, if you want centralized key distribution in 
    the manner you are describing, Kerberos is a far
    better fit and has been around forever. Kerberos in
    general has a lot of very appealing properties for
    fast mobility and scaling.

		  Mike