Subject: [mobile-ip] 3 pairs of IPSec SA for MN/HA signaling protection

From: Wenxiao He <[email-masked]>
Date: Mon, 14 Oct 2002 12:02:11 -0700

As per current draft of IPSec in MIPv6, 3 pairs of IPSec
SAs are needed for MN/HA signaling protection, plus another
pair, though optional, for payload packets.

I see that these many SAs are the natural outcome of
applying IPSec to MIPv6, but the number of 3 pair of 
SAs sounds clumsy.

IMHO, when using IPSec to protect MN/HA signaling, we
should tailor aggressively ( instead of fine tune )
IPSec to let it work smoothly with MIPv6.

-- 
Wenxiao He

---

From: [email-masked]
Date: Tue, 15 Oct 2002 10:32:09 +0300

Hesham Soliman (EAB) wrote:
> => Do you have an alternative?
> 

2 alternatives:

1. Make all Mobile IPv6 signaling use the same protocol (the Mobility Header), therefore reducing the number of SA pairs from 3 to 1.

2. Allow usage of the Binding Authorization Data option in all Mobile IPv6 signaling messages, thereby utilizing the same security relationship for them all regardless of the different protocols the signaling messages are carried over.

Doing both of the above would simplify the implementations even further. 

Regards,

	Jarno