Subject: RE: [mobile-ip] observation on the mip/ipsec draft

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 29 Oct 2002 00:02:20 +0100

=> Well, you can't use AH for payload traffic (typically)
or HOTI/HOT. So if you use AH for the rest, you will need
to SAs instead of one.

  > 
  >  > => This might be due to my ignorance of IKE: 
  >  > Notwithstanding the API part, can the IKE negotiation 
  >  > distinguish between the different policy configurations 
  >  > that are needed when your proposal is used, compared to 
  >  > those needed when the current draft is used? 
  >  > If they can, then we can keep both options in the draft.
  >  > Otherwise, we would have to use only one; yours or 
  >  > the current method.
  > 
  >    I'm not certain that I understand the question. 
  >    The policy decision needed is at the home agent
  >    and that's whether it should authorize the use of
  >    a particular home address with a given credential.
  >    I think this is the same requirement for each proposal
  >    which IKE will handle as well as IKE handles it :)

=> I'll think about it more and let you know.

Hesham

  > 	     Mike

---

From: Michael Thomas <[email-masked]>
Date: Mon, 28 Oct 2002 15:33:31 -0800 (PST)

Hesham Soliman (EAB) writes:
 >   >    Is there actually any reason to be specific? I'm
 >   >    not a fan of AH, but I don't believe that AH
 >   >    would require any more SA's. Both ESP and AH
 >   >    provide integrity protection, so they both meet
 >   >    the requirement as far as I can tell.
 > 

   AH does payload traffic... remember
   historically there didn't even used to be an
   ESP!

		Mike

---

From: Jari Arkko <[email-masked]>
Date: Tue, 29 Oct 2002 01:59:19 +0200

I think we are coming close to a consensus to include text
in the MIPv6 draft for allowing either implementation model
(authz in the SPD or in the MIPv6 module).

Mike, should we move on to discuss your other issues.
And we should talk more about the number of SAs. I mean
obviously everyone agrees with the benefit but I at least
feel I haven't fully understood how the SPDs are to be
set up (in either approach) if we want to use less SAs.

Jari