Subject: RE: [mobile-ip] questions on binding update

From: "Jean-Michel COMBES" <[email-masked]>
Date: Tue, 23 Jul 2002 11:32:53 +0200

Hi,

Concerning the IPsec use with MIPv6, another document :

Francis Dupont, How to make IPsec more mobile IPv6 friendly, June 2002,
Internet Draft, draft-dupont-ipsec-mipv6-01.txt

Concerning the key management, IMO, that depends on the context :

1. MN and CN in the same administrativ domain (ie. "Brother CN" case)
Use of a local PKI or AAA

2. MN and CN in different administrative domains and partnership between
the
two domains (ie. "Friend CN" case)
Use of AAA

3. MN and CN in different administrative domains and no partnership
between
the two domains (ie. "Random CN" case)
Use of DNSsec

Concerning the right kind of *authorization* information, the certs must
contain the link Home Address/ID(NAI,user-FQDN, etc.).

Regards.

JMC.

France Telecom R&D - DTL/SSR
Jean-Michel COMBES, Internet/Intranet Security
E-Mail : [email-masked]
Phone +33 (0)1 45 29 45 94, Fax +33 (0)1 45 29 65 19
PGP fingerprint : 07C6 37BF 4DE5 1CE1 EEB1 1F13 5D75 9E33 CFA7 0214
-----Message d'origine-----
De : Pekka Nikander [mailto:[email-masked]]
Envoye : vendredi 19 juillet 2002 06:57
A : zhang zhishou
Cc : Mobileip
Objet : Re: [mobile-ip] questions on binding update

zhang zhishou wrote:
> Hi, folks:
>
> I am newbie in Mobile IP and IPsec. Please forgive me for my stupid
> questions.
>
> Why is IPsec not used for binding updates between MN and CN?
> If this is topic that was already discussed and clarified, please give
me
> some reference, so that I could catch up with it.
Short answer:  Problems with scalability in key management.
Longer answer:  How do you arrange a pair of SAs between two
arbitrary nodes that may not have anything to do with each other?
Well, you could have a global PKI, but such thing does not exist
today, and even if it did, you would need to make sure that the
PKI carries the right kind of *authorization* information, in
addition to public keys for authentication.
Still longer answer:  There are lots of related text, but I don't
know if there is anything that just discusses your question and
nothing else.  There is something in the earlier texts, e.g.
- Pekka Nikander,  An Address Ownership Problem in IPv6,
   work in progress, Internet-Draft (expired), February 2001.

http://www.tml.hut.fi/~pnr/publications/draft-nikander-ipng-address-owne
rshi
p-00.txt
- Michael Roe, Greg O'Shea, "Child-proof Authentication for Mobile
IPv6,"
   CCR, April 2001, http://www.research.microsoft.com/~mroe/ccr2001.pdf
--Pekka Nikander