Subject: [mobile-ip] Issue 49: Got a new home address, what about the SAs to HA?

From: Jari Arkko <[email-masked]>
Date: Tue, 25 Jun 2002 20:19:08 +0300

(Originally brought up by Charlie Perkins.)

Background: RFC 3041 procedures or the announcement of a new prefix
may lead to the creation of a new home address for the mobile node.
If the mobile node changes its home address, it has to update its
security association with the home agent, as IPsec SAs are dependent
on the addresses in the following way:

- Home address will be the destination for HA -> MN traffic and
   used as an SA lookup index
- Home address will be used in the SPD entry or selectors that govern
   the use of the MN -> HA SA.

This is problematic in the sense that no such automatic modifications
take place for manually configured SAs. Where IKE-based SAs are used,
SAs can be renegotiated.

Question: Does this need treatment in the specification. If so, what?

Proposal: There seems to be multiple ways to deal with this:

1) This isn't an issue, don't use automatic prefix discovery
or RFC 3041 if you have manual SAs. Duh.

2) As above, but we should document this restriction in the spec.

3) Have some functionality in the MN/HA to be able to "move" i.e.
modify the old SAs to use new addresses.

4) As above, but change the keys at the same time as we move/modify
the SAs. The algorithm and whatever else can remain the same, but the
shared key ought to change. The new key could be: HMAC_MD5(old_key,
new home address).

---

From: "James Kempf" <[email-masked]>
Date: Tue, 25 Jun 2002 13:40:28 -0700

Jari,

IMHO, I'd say 2). We don't need to introduce any additional mechanism, but people should be warned. 

        jak

---

From: Jari Arkko <[email-masked]>
Date: Thu, 27 Jun 2002 20:12:23 +0300

> IMHO, I'd say 2). We don't need to introduce any additional mechanism, but people should be warned. 

Yes. Let's go with that.

Jari