Subject: RE: [mobile-ip] Unresolved issue #13: SPI field

From: "Mohamed Khalil"<[email-masked]>
Date: Tue, 9 Apr 2002 14:53:04 -0500

Hi Jari,

-----Original Message-----
From: Jari Arkko [mailto:[email-masked]]
Sent: Tuesday, April 09, 2002 1:35 PM
To: [email-masked]'
Subject: [mobile-ip] Unresolved issue #13: SPI field

Background: Draft 16 has an SPI field in the Authentication Data
parameter. This field has existed in the draft since draft 14.
However, in draft 16 it must be set to zero and the message is dropped
if on receipt it contains something else. Even the potential semantics
of the field are somewhat unclear. Is it going to be an algorithm
identifier, or an IPsec-like dynamic entity? On the other hand, there
is a need to signal other potential security schemes beyond RR in BUs,
and how can we do this?

Question: Should the SPI field be kept?

MK> I think it is useful to leave it for future security proposals. Also, I
think we should remove the sentence
"The Authentication Data parameter is valid only in the Binding
   Request, Binding Update, and Binding Acknowledgment messages."

because this authentication data parameters might be used to authenticate
some other future messages proposed by other drafts.

Proposal: This SPI field doesn't seem very useful, remove
it. For ability to provide other security mechanisms, the
following building blocks can be used:
- Flags in the RR or BU messages
- New parameters in the RR or BU messages

------------
Issue list at
http://www.piuha.net/~jarkko/publications/mipv6/MIPv6-Issues.html

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Tue, 9 Apr 2002 13:23:54 -0700

Please remove it.

-mohan

> Sent: Tuesday, April 09, 2002 11:35 AM
> Background: Draft 16 has an SPI field in the Authentication 
> Data parameter. This field has existed in the draft since 
> draft 14. However, in draft 16 it must be set to zero and the 
> message is dropped if on receipt it contains something else. 
> Even the potential semantics of the field are somewhat 
> unclear. Is it going to be an algorithm identifier, or an 
> IPsec-like dynamic entity? On the other hand, there is a need 
> to signal other potential security schemes beyond RR in BUs, 
> and how can we do this?
> 
> http://www.piuha.net/> ~jarkko/publications/mipv6/MIPv6-Issues.html
> 
> 
>

---

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Fri, 12 Apr 2002 11:36:31 +0200

Agreed.

Hesham

  > From: Michael Thomas [mailto:[email-masked]]
  > Sent: Tuesday, April 09, 2002 9:56 PM
  > To: [email-masked]
  > Cc: [email-masked]'
  > Jari Arkko writes:
  >  > it.
  >    Agree.
  > 		Mike

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 17 Apr 2002 04:51:30 +0200 (CEST)

> The SPI field has to be available, to allow for selection of
> the appropriate Binding Security Association to be used for
> calculations involving the authentication data.

Charlie,

[Just in case this didn't already get resolved]

Do you see the SPI field being used by anything that is in the current
mipv6 draft?

If not, why can't any security scheme which needs an SPI field define
an SPI option to carry this information?

   Erik