Subject: RE: [mobile-ip] Binding Authorization data for Binding Update toH ome Agent

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Mon, 14 Oct 2002 15:45:55 +0200

> > > It is necessary to allow manual configuration of security 
  > > associations
  > > > between mobile node and home agent in the same way as is done
  > > > today in Mobile IPv4, which is manifestly simple and effective.
  > > 
  > > Couple issues:
  > > - yet one more way of doing the same thing (manual SA 
  > configuration
  > > 	between HA and MN).
  > 
  > The method by which the authorization is done between MN 
  > and HA would necessarily be a property of the MN-HA 
  > security relationship (as well as the key(s)), so there 
  > should be no problem in MN choosing the method to use. 
  > Also, the method exists already for the MN-CN case, so the 
  > only additional burden on the MN is to be able to utilize 
  > code it already has if it has been configured to do so.

=> I don't think it's so simple. The HA does not 
implement an authorisation data option and should not
really, given that we already have strong authentication
with IPsec. This is an additional (perhaps unmotivated) burden
on the HA. I don't see the point.

  > 
  > > - does not provide a way for RR signaling to be encrypted between
  > > 	HA and MN (which is really important for securing RR)
  > > 
  > 
  > Non-issue. As per the current specification 
  > (draft-ietf-mobileip-mipv6-ha-ipsec-00.txt), the IPsec SAs 
  > for the two cases are totally separate, so the MN-HA and 
  > MN-CN cases are orthogonal. I.e. the method used for MN-HA 
  > BU authorization has nothing to do with RR signaling 
  > protection between MN and HA. IPsec would still be used for 
  > MN-HA tunnel protection.
  > 
  > I see no reason to block the usage of BAD for MN-HA MH 
  > protection. It makes no real difference to MN, and Home 
  > Agents should be free to use the method best suited to the 
  > implementation.

=> But why is it needed? can you give some motivation for this?
I think technically it will work, but since 
it doesn't add anything, I don't see the point
of having more code to write, whether it's 
in the MN or the HA.

Hesham

---

From: Charlie Perkins <[email-masked]>
Date: Mon, 14 Oct 2002 08:07:42 -0700

Hello Hesham,

Every home agent, by virtue of the fact that it is an Internet node,
is also by definition a correspondent node and thus would implement
the Binding Authorization Data option.  Thus, there is no additional
burden, and according to interoperability test and years of experience
it is very simple.  There seems to be no good reason to prohibit it,
and it is very useful.

Regards,
Charlie P.