Subject: RE: [mobile-ip] Draft 15

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 25 Sep 2001 08:26:22 +0200

Hello Charlie,

We seemed to have concensus earlier (if I dare say so) that IPsec 
was to stay in the draft. But draft-14 removed IPsec, I didn't see it in
the list of changes. The draft seems to assume that the authentication
data suboption is mandated and IPsec is a MAY. I'm not sure that this 
reflects the concensus on the list, but I might have missed something. 
Comments ?
 
BTW your name is misspelt in the link. 

Regards,
Hesham

> -----Original Message-----
> From:	Charles E. Perkins [SMTP:[email-masked]]
> Sent:	Tuesday, 25 September 2001 7:08
> To:	Mobile IP Working Group
> Cc:	Basavaraj Patil (NTC/Dallas); Phil Roberts
> Subject:	[mobile-ip] Draft 15
> 
> Hello folks,
> 
> I have done a rough edit on revision 15 of Mobile IPv6.
> It needs some proofreading.  There may still be some problems
> left over because of eliminating the Mobile Router capability,
> and the "Prefix Length" field of the Binding Update.  Also,
> I am still puzzling over the e-mail about how a mobile node
> should get the link-layer address of the home agent when it
> returns home.
> 
> Here is the current draft:
> 	http://people.nokia.net/charlep/txt/mobilev6/mobilev6.txt
> 
> 
> 
> Here is a list of changes:
> 
>     -  Removed the Mobile Router Prefix Length Sub-Option
>    
>     -  Removed the Prefix Length field from the Binding Update.
>    
>     -  Reworded the specification so that the Home Agent now has to
>        perform Duplicate Address Detection for the mobile node's address
>        on all the prefixes for which the router is performing home agent
>        service.
>    
>     -  Removed the section about Mobile Routers
>    
>     -  Added the Authentication Data Sub-option; reorganized the section
>        about computing authentication data.
>     
>     -  Specified that the Home Agent lifetime is by default the same as
>        the Router lifetime, in a Router Advertisement.
>     
>     -  Specified that Binding Updates with zero lifetime and the 'A' bit
>        set should cause a Binding Acknowledgement to be sent back to the
>        Source IP address of the Binding Update.
> 
>     -  Qualified the allowable times when a mobile node can send a
>        Binding Update to a correspondent node
> 
>     -  Added text allowing the correspondent node to extend an existing
>        Routing Header by also including the care-of address as the entry
>        of a routing header to be visited immediately before the home
>        address.  In this way, for instance, the mobile node can be an
>        intermediate node of a path along the way to some other node.
>    
>     -  Removed the Home Address field from the Home Agent Address
>        Discovery Request Message.
>     
>     -  Noted that ICMP Unreachable forms a potential mechanism by which
>        a malicious node can cause a correspondent node to delete a valid
>        entry from its Binding Cache.
> 
>     -  Specified that, when a router stops offering home agent services
>        by turning off the 'H' flag, the mobile node has to delete the
>        corresponding entry from its Home Agent list. 
> 
> 
> 
> I'll wait a bit longer before sending it, depending on current
> mailing list discussion and any other comments that may be
> contributed.  Surely there will be some other changes that have
> to be made anyway, but it is possible to imagine that they will
> be small ones.
> 
> 
> Regards,
> Charlie P.

---

From: Charlie Perkins <[email-masked]>
Date: Tue, 25 Sep 2001 00:11:45 -0700

Hello Hesham,

As best I can figure it out, one can use IPsec for authentication
if you can get the selectors to select the right security association,
but some (or most) implementations aren't selective enough
to be assured of always picking out the right security association
depending on which destination options (or future ones) may
be in use.

So, I have made an authentication data sub-option that MUST be
supported.  IPsec MAY be used instead, and if so I don't think
that there is any additional specification within the Mobile IPv6
document that is needed for this.  If IPsec is used, then the
Authentication Data Sub-Option does not have to be present.

I hope this is good enough to satisfy the current needs, as well
as the previous discussion about how we could not count on
using IPsec in its current form.  I hope you like the new Sub-Option,
and if you have suggestions about how to make better wording
for allowing IPsec I'd be interested in that, too.

Regards,
Charlie P.