Subject: RE: [mobile-ip] Unresolved issue #14: RR ESP protection keyword ( Replay)

From: "Karen E Nielsen (TED)" <[email-masked]>
Date: Wed, 10 Apr 2002 19:58:33 +0200

The majority of my mail got lost on the way.
Hereby the full version (I hope).

> 
> 
>  > 
>  > Text: New contents of 9.6
>  > 
>  > The Return Routability procedure described in Section X.X.X assumes
>  > that the confidentiality of the HoTI and HoT messages is 
>  protected as
>  > it is tunneled from the home agent to the mobile node. 
>  Therefore, the
>  > home agent MUST support IPsec ESP for the protection of RR
>  > packets. Support for a non-null encryption transform MUST be
>  > available. It isn't necessary (or even possible) to distinguish
>  > between different kinds of RR packets in this case.
>  > 
>  > The use of ESP for RR protection is optional and controlled by
>  > configuration of the IPsec Security Policy Database both at 
>    the mobile
>  > node and at the home agent.
>  > 
>  > As described earlier, the Binding Update and Binding 
> Acknowledgement
>  > messages already need protection even if they are not tunneled. As
>  > these messages employ the Mobility Header in a similar 
> manner to the
>  > RR messages, one way to set up the Security Policy Database is to
>  > protect all traffic to the mobile node and back with IPsec 
>     ESP if the
>  > protocol in the packet is Mobility Header.
>  
> 
> Don't you need to specify whether the ESP should be deployed 
> in tunnel or in transport mode
> in the SPD ? As I understand you, ESP transport mode should 
> be used for the BU/BAck whereas the RR should
> be covered by ESP tunnel mode, how can they then be covered 
> by the same SP ? 
>  
> 
> Karen
> 
Karen