Subject: [mobile-ip] questions on binding update

From: zhang zhishou <[email-masked]>
Date: Fri, 19 Jul 2002 12:37:45 +0800

Hi, folks:

I am newbie in Mobile IP and IPsec. Please forgive me for my stupid
questions.

Why is IPsec not used for binding updates between MN and CN?
If this is topic that was already discussed and clarified, please give me
some reference, so that I could catch up with it.

thanks in advance !!

zzs

---

From: Pekka Nikander <[email-masked]>
Date: Fri, 19 Jul 2002 07:56:46 +0300

> some reference, so that I could catch up with it.

Short answer:  Problems with scalability in key management.

Longer answer:  How do you arrange a pair of SAs between two
arbitrary nodes that may not have anything to do with each other?
Well, you could have a global PKI, but such thing does not exist
today, and even if it did, you would need to make sure that the
PKI carries the right kind of *authorization* information, in
addition to public keys for authentication.

Still longer answer:  There are lots of related text, but I don't
know if there is anything that just discusses your question and
nothing else.  There is something in the earlier texts, e.g.

- Pekka Nikander,  An Address Ownership Problem in IPv6,
   work in progress, Internet-Draft (expired), February 2001.
   http://www.tml.hut.fi/~pnr/publications/draft-nikander-ipng-address-ownership-00.txt

- Michael Roe, Greg O'Shea, "Child-proof Authentication for Mobile IPv6,"
   CCR, April 2001, http://www.research.microsoft.com/~mroe/ccr2001.pdf

--Pekka Nikander

---

From: Francis Dupont <[email-masked]>
Date: Fri, 19 Jul 2002 10:36:59 +0200

=> it may be used but it is not (more) the default solution
because it needs a proper authorization and some kind of global PKI.
 I have a ton of mails about this in my laptop but I am
currently in the Narita Express (http://www.nex.v6pc.jp/)
so it is a bit hard to send them...
 When you'll know well please read my draft about IPsec and Mobile iPv6:
draft-dupont-ipsec-mipv6-01.txt

Regards

[email-masked]

Ps I've seen an answer from Pekka, so you should already have
an idea about the authorization issue.

---

From: Francis Dupont <[email-masked]>
Date: Fri, 19 Jul 2002 10:36:59 +0200

Regards

---

From: Pekka Nikander <[email-masked]>
Date: Fri, 19 Jul 2002 07:56:46 +0300

--Pekka Nikander