Subject: RE: [mobile-ip] MIPv6 rev 18 - Editorial in chapter 8

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Thu, 4 Jul 2002 18:10:36 +0200

Hi Vijay, 

My comment was two fold:

1. Is it worth it? You say, yes it is
because we get triangulr routing. 
I'm not so sure that triangular routing
is much better, but anyway this is not 
my biggest concern. That one is below

2. The draft is very unclear about the 
rationale. I know it says that the HAO
can be accepted if IPsec is used, but I
think more text is needed there.

(2) is more important to me than (1), because
I was a bit confused by section 8, and I would
imagine that someone reading this for the first
time will be more confused. 

Hesham

  > -----Original Message-----
  > From: Vijay Devarapalli [mailto:[email-masked]]
  > Sent: Wednesday, July 03, 2002 8:27 PM
  > To: Hesham Soliman (EAB)
  > Cc: [email-masked]
  > Subject: Re: [mobile-ip] MIPv6 rev 18 - Editorial in chapter 8
  > 
  > 
  > 
  > 
  > Hesham Soliman (EAB) wrote:
  > 
  > > Sorry, unfinished sentence at the end. I
  > > just discovered that I sent it by accident.
  > > 
  > > The last paragraph should read:
  > > Also, I still wonder about the point behind
  > > the MUST in 8.1 for the HAO. We all agreed that
  > > it MUST be supported when a BCE entry, what is 
  > 
  > 
  > actually no. we agreed that HAO MUST be processed if the home
  > address can be verified. verifiability of the home address can be 
  > achieved by mechanisms other than the a valid BCE entry. 
  > for example, 
  > lets asumme the MN and CN have an IPsec protected data session with
  > the SA created on MN's home address. in this case the verifiability 
  > comes from the IPsec SA. another case is, when the CN and MN belong
  > to the same 'trusted' domain. in this case the HAO can be 
  > processed. 
  > there are other mechanisms like Rajeev's and Charlie's HAO tagging
  > proposal to verify the HoA.
  > 
  > IMO, HoA verifiability is something I believe we can solve. it
  > would be wrong to restrict ourselves now by saying HAO MUST NOT be
  > processed if a vaild BCE does not exist.
  > 
  > > the point of having it supported just in case
  > > IPsec exists? 
  > > Is it to use triangular routing? There is nothing
  > 
  > 
  > yes. you can have triangular routing if the home address can be
  > verified.
  > 
  > regards
  > Vijay
  >

---

From: "James Kempf" <[email-masked]>
Date: Fri, 5 Jul 2002 08:37:55 -0700

> think more text is needed there.

I was very confused by this.

If IPsec is required for HAO, then doesn't that mean that the CN must have an IPsec SA with the MN in order to do RO? If so, then
what was the point of developing the RR algorithm?

This seems to me to be a very limiting requirement.

            jak

---

From: Jari Arkko <[email-masked]>
Date: Sun, 07 Jul 2002 20:43:21 +0300

> This seems to me to be a very limiting requirement.

No, the discussion was that HAO can be accepted when *either* RR or IPsec has
been used. So, IPsec SA is not a requirement for RO.

Jari

---

From: "James Kempf" <[email-masked]>
Date: Mon, 8 Jul 2002 08:48:35 -0700

Jari,

Thanx for the clarification.

I think the draft needs to be clearer about this. Perhaps it could be stated in the requirements section.

            jak

----- Original Message -----
From: "Jari Arkko" <[email-masked]>
To: "James Kempf" <[email-masked]>
Cc: "Hesham Soliman (EAB)" <[email-masked]>; "'Vijay Devarapalli'" <[email-masked]>;
<[email-masked]>
Sent: Sunday, July 07, 2002 10:43 AM
Subject: Re: [mobile-ip] MIPv6 rev 18 - Editorial in chapter 8

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 08 Jul 2002 10:51:45 -0700

hi Hesham,

> my biggest concern. That one is below

I will avoid getting into a debate whether triangular 
routing is better. (IMO it is better than reverse tunneling 
if we can avoid the possible reflection attacks).

> time will be more confused.

not just IPsec. basically we are tying the processing of
HAO to the verifiability of the home address (to avoid
reflection attacks).

maybe we can include more text to explain this clearly.

Vijay

---

From: Jari Arkko <[email-masked]>
Date: Tue, 09 Jul 2002 11:36:40 +0300

> I think the draft needs to be clearer about this. Perhaps it could be stated in the requirements section.

Yes. In 8.1, I have made the following clarification:

    -  The node MUST be able to validate a Home Address option received
       in any IPv6 packet as described in Section 9.2.2.

=>

    -  The node MUST be able to process a Home Address option in any
       IPv6 packet, and validate the option using an IPsec SA, as
       described in Section 9.2.2.

And then addded a new item in 8.2:

    -  The node MUST be able validate a Home Address option using an
       existing Binding Cache entry, as described in Section 9.2.2.

Does this work for everyone? I assigned issue #54 for this.

Jari