Subject: Re: [MEXT] FW: New Version Notification for draft-patil-mext-mip6issueswithipsec-00

From: Behcet Sarikaya <[email-masked]>
Date: Mon, 27 Oct 2008 14:20:35 -0700 (PDT)

Hi Raj,
  I read this draft with interest. I remember long and heated debate in 6man list on IPSec being mandatory in IPv6.
  Overall I kind of disagree with you saying that MIPv6 hasn't been widely deployed just because of IPSec. Probably the status of IPv6 deployment has something to do with it.

Regards,

Behcet

________________________________
From: Basavaraj Patil <[email-masked]>
To: "[email-masked]" <[email-masked]>
Sent: Monday, October 27, 2008 12:27:33 PM
Subject: [MEXT] FW: New Version Notification for draft-patil-mext-mip6issueswithipsec-00

FYI,

------ Forwarded Message
From: ext IETF I-D Submission Tool <[email-masked]>
Date: Mon, 27 Oct 2008 09:55:13 -0700 (PDT)
To: Basavaraj Patil <[email-masked]>
Cc: Charles Perkins <[email-masked]>, <[email-masked]>
Subject: New Version Notification for
draft-patil-mext-mip6issueswithipsec-00

A new version of I-D, draft-patil-mext-mip6issueswithipsec-00.txt has been
successfuly submitted by Basavaraj Patil and posted to the IETF repository.

Filename:  draft-patil-mext-mip6issueswithipsec
Revision:  00
Title:   Issues related to the design choice of IPsec for Mobile IPv6
security
Creation_date:  2008-10-27
WG ID:   Independent Submission
Number_of_pages: 15

Abstract:
Mobile IPv6 as specified in RFC3775 relies on IPsec for security.  An
IPsec SA between the mobile node and the home agent provides security
for the mobility signaling.  Use of IPsec for securing the data
traffic between the mobile node and home agent is optional.  This
document analyses the implications of the design decision to mandate
IPsec as the default security protocol for Mobile IPv6 and recommends
revisiting this decision in view of the experience gained from
implementation and adoption in other standards bodies.

The IETF Secretariat.

------ End of Forwarded Message

_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext

_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext

---

From: Basavaraj Patil <[email-masked]>
Date: Mon, 27 Oct 2008 16:25:07 -0500

Hi Behcet,

The main point of the I-D is that the choice of IPsec as the protocol for
securing MIP6 signaling was premature and hence needs to be reconsidered.

-Raj

On 10/27/08 4:20 PM, "ext Behcet Sarikaya" <[email-masked]> wrote:

>   Overall I kind of disagree with you saying that MIPv6 hasn't been widely
> deployed just because of IPSec. Probably the status of IPv6 deployment has
> something to do with it.
> 
> Regards,
> 
> Behcet
> 
>

---

From: "Davis, Terry L" <[email-masked]>
Date: Wed, 29 Oct 2008 00:03:40 -0700

All

One of the key things that we all need to press on, is to FORCE the IPSec vendors to STANDARDIZE their implementations and terminology so that IPSec interoperability is actually achievable (without one of the few existing real IPSec wizards) by normal networking/security folks.

This will be especially problematic for aviation since we will have so many different PKIs to interface with and our aircraft will have to seamlessly handoff from PKI to PKI around the world to re-establish their IPSec tunnels as they change Navigation Service Providers.  For us, having a "single vendor" IPSec solution or "single PKI" solution (which is how the corporate world solves the IPSec non-interoperability problem now) for aviation is a true "non-starter".

All that said, from my point-of-view, IPSec MUST remain mandatory in IPv6; it may need another working group to get implementations and interfaces standardized though.

Take care
Terry

PS: This is also very problematic for DNSSec which has become critical for the TLDs.  I expect some interesting discussions on that in Cairo next week.

________________________________
From: [email-masked] [mailto:[email-masked]] On Behalf Of Behcet Sarikaya
Sent: Monday, October 27, 2008 2:21 PM
To: Basavaraj Patil; [email-masked]
Subject: Re: [MEXT] FW: New Version Notification fordraft-patil-mext-mip6issueswithipsec-00

Hi Raj,

Regards,

Behcet

FYI,

------ Forwarded Message
From: ext IETF I-D Submission Tool <[email-masked]<mailto:[email-masked]>>
Date: Mon, 27 Oct 2008 09:55:13 -0700 (PDT)
To: Basavaraj Patil <[email-masked]<mailto:[email-masked]>>
Cc: Charles Perkins <[email-masked]<mailto:[email-masked]>>, <[email-masked]<mailto:[email-masked]>>
Subject: New Version Notification for
draft-patil-mext-mip6issueswithipsec-00

Abstract:

The IETF Secretariat.

_______________________________________________
MEXT mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/mext

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 29 Oct 2008 10:03:26 +0200

[Hannes] Interestingly, Mobile IPv4 is not widely implemented/used either.

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Wed, 29 Oct 2008 10:05:51 +0200

I should also add: 

Mobile IP in general is facing a couple of challenges and producing complex
specifications to make it harder for implementers to get started will not
make it easier. 

With regard to the challenges: Security is only one of them, I agree. But we
need to start somewhere.

>-----Original Message-----
>From: Hannes Tschofenig [mailto:[email-masked]] 
>Sent: 29 October, 2008 10:03
>To: 'Davis, Terry L'; 'Behcet Sarikaya'; 'Basavaraj Patil'; 
>[email-masked]'; 'Mobile Platform Internet Mailing List'
>Subject: RE: [MEXT] FW: New Version Notification 
>fordraft-patil-mext-mip6issueswithipsec-00
>
>  Overall I kind of disagree with you saying that MIPv6 hasn't 
>been widely deployed just because of IPSec. Probably the 
>status of IPv6 deployment has something to do with it.
>