Subject: [MOBILE-IP] Security and Mobile-ip...

From: Cristian Constantin <[email-masked]>
Date: Tue, 14 Sep 1999 16:15:59 +0200

Hello!

One question related to the authentication and anti-reply protection in
Mobile-Ip protocol.

The MN has to authenticate its RegReq sent to its HA. MN and HA have to
use anti-reply protection techniques when exchanging RegReq and RegRep.

Currently the RFC 2002 defines the above mentioned packets (RegReq and
RegRep) as UDP having the authentication part (Extension type 32 in a
RegReq) and the anti-reply protection part (Identification field both in
RegReq and RegRep) in their payload.

Why not using a more standard protocol like IP Authentication Header (in
transport mode for example...). IP Authentication Header is defined in
RFC 2402.

My point is that if you already have a module that does IPSec processing
(RFC 2401) your mobile-ip software could interact with it (Of course if
you use AH...). The security related stuff would be processed more
uniformly in your system...

---

From: Vipul Gupta <[email-masked]>
Date: Tue, 14 Sep 1999 10:32:32 -0700

Mobile IPv6 does indeed use standard IPSec headers for authentication.
   I suspect the only reason Mobile IPv4 does not is historical -- the IPSec
   protocol descriptions were still in flux when the basic Mobile IP
   architecture was agreed upon.

   In hindsight, the separation of the MAC (in auth extension) and
   the replay detection field (in the payload) is unfortunate. It would
   have been better to club both together (in an auth extension or
   auth header). Doing so makes it easy to add replay detection between
   other mobile IP entities in a natural fashion, e.g. if each auth
   extension had an  (optional) replay detection field, one could
   provide replay detection between the FA-HA (say) quite easily if
   needed.

   vipul

> X-Accept-Language: en
> MIME-Version: 1.0
> Content-Transfer-Encoding: 7bit
> Date: Tue, 14 Sep 1999 16:15:59 +0200
> From: Cristian Constantin <[email-masked]>
> Subject: [MOBILE-IP] Security and Mobile-ip...
> To: [email-masked]
>
> Hello!
>