Subject: Re: MIPv6 questions

From: Mohan Parthasarathy <[email-masked]>
Date: Tue, 4 Apr 2000 09:51:50 -0700 (PDT)

>    		o If the home-address option precedes the authentication
>    header, does the AH calculate its ICV value based on a source address of
>    the home-address or the original value?
> 
> => the home-address because of the order of headers (I-D 11, section 10.2).
> 
>    
> => just read the last I-D section 10.2 which is very clear about IPSec
> processing and header ordering.
> 
The latest draft on mobile ipv6 is not very clear on what exact bits
are passed through for computing the AH ICV on inbound. One can only
infer how it should be on inbound. The steps on outbound are (from section
10.2)

1) Insert the Dst options and put ip6_src = COA.

2) Compute the AH ICV.

For the reciever to compute the same ICV, ip6_src should be still
COA. But from section 5.4, it says that the receiving node replaces
the source address in the IPv6 header with the Home Address in
the Home Address option. Does this mean we replace the address
and then compute the ICV ? This won't be correct as we computed
the ICV with ip6_src = COA.

In the case of Routing Header does'nt the sender compute the AH ICV
after constructing a pseudo IP header as it would look like on the receiver
i.e If "S" wants to send packet to "D", through hops I1, I2,
the ICV is computed with ip6_src = S, ip6_dst = D, Routing header
with I1 and I2 though the packet when it is actually sent, it
is sent to I1 i.e packet from S looks like

ip6_src = S, ip6_dst = I1, Routing header I2, D

but the ICV on "S" is computed with 

ip6_src = S, ip6_dst = D, Routing header I1, I2.

Similarly, for Home Address Option, the sender should construct
the pseudo header as it would appear on the receiver when it
computes the ICV. On outbound,

1) Insert the HOME address option before the AH header.
2) Compute the AH ICV.
3) Replace the ip6_src with the COA.

And on Inbound, we can do the replacement first and then compute
the AH ICV.  The draft does not mention what is contained in
the Home address option while computing the ICV. If instead of
replacement, we "swap" the ip6_src with the Home address,
we get exactly what we did on outbound.

Nice to know what the existing implementations do.

-mohan

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Francis Dupont <[email-masked]>
Date: Tue, 04 Apr 2000 19:29:36 +0200

In your previous mail you wrote:

   The latest draft on mobile ipv6 is not very clear on what exact bits
   are passed through for computing the AH ICV on inbound.

=> the last draft is very clear for me but if you have better way
to explain IPSec processing then you can propose improvements to
the authors (it is a case where nothing is too good :-).

[email-masked]

---

From: Mohan Parthasarathy <[email-masked]>
Date: Wed, 5 Apr 2000 09:55:04 -0700 (PDT)

> the authors (it is a case where nothing is too good :-).
In section 5.4 and other places, the draft says that when a packet
with HOME address option is recieved it should be processed first
before IPSEC is done. Thus while AH ICV is being computed ip6_src of
the IPv6 header contains the HOME address. If you refer to 10.2
for outbound processing with Home address options, it states that
HOME address option is inserted, ip6_src is replaced with Care
of Address and then AH ICV is computed. ip6_src is not same in
these two cases and hence ICV can't be the same. Am i reading
anything wrong here ?

-mohan

---

From: Francis Dupont <[email-masked]>
Date: Wed, 05 Apr 2000 21:02:08 +0200

before IPSEC is done.

=> the idea is to use the home address for SA lookup.

   Thus while AH ICV is being computed ip6_src of the IPv6 header contains
   the HOME address.

=> it is a consequence of the previous point: inbound IPSec processing
should be done after the home address option processing. The real problem
is to know what is it exactly the home address option processing, texts
say replace addresses in source by the one in the option, verbal
explanations say to swap them which is better because the care-of address
(the source address before processing) must be kept and protected.

   If you refer to 10.2 for outbound processing with Home address
   options, it states that HOME address option is inserted, ip6_src
   is replaced with Care of Address and then AH ICV is computed. ip6_src
   is not same in these two cases...

=> the piece you'd like is the AH processing rule for the home address
option which depends a bit of the way you "fully assemble" the packet.