Subject: RE: [mobile-ip] observation on the mip/ipsec draft

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Mon, 28 Oct 2002 23:37:20 +0100

Mike, 

A couple of comments for the benefit of the list.

  > Here's the method: 
  > 
  > 1) A SDP entry for all mobile nodes is
  >    required. This entry at a minimum says to
  >    not pass any MH data without a valid SA. The
  >    SA can be tunnel or transport, ESP or AH,
  >    and MAY allow other data to pass (ie, it does
  >    not require IPsec packet filtering capability).

=> Since the major immediate benefit from your 
suggestion is reducing the no of SAs. I suggest 
that we use ESP, because it's good enough
(with non null authentication) for BUs, MPS/MPA, 
HOTI/HOT and payload traffic. Having AH will cause
more SAs for no real reason. With ESP only
we can have 1 SA.

  > 
  > 2) At SA establisment time (either in IKEd or
  >    manually), the MIP module is informed of the
  >    binding of SA/SPI to home address for the
  >    mobile node. This is purely an API issue, 
  >    most likely a setsockopt to MIP. This binding
  >    can be very specific as needed, say, in a
  >    service provider environment, or very loose
  >    essentially saying that auth == authz which
  >    may be an acceptible simplifying assumption
  >    for enterprise.

=> This might be due to my ignorance of IKE: 
Notwithstanding the API part, can the IKE negotiation 
distinguish between the different policy configurations 
that are needed when your proposal is used, compared to 
those needed when the current draft is used? 
If they can, then we can keep both options in the draft.
Otherwise, we would have to use only one; yours or 
the current method.

Hesham

---

From: Michael Thomas <[email-masked]>
Date: Mon, 28 Oct 2002 14:59:21 -0800 (PST)

> more SAs for no real reason. With ESP only

   Is there actually any reason to be specific? I'm
   not a fan of AH, but I don't believe that AH
   would require any more SA's. Both ESP and AH
   provide integrity protection, so they both meet
   the requirement as far as I can tell.

 > Otherwise, we would have to use only one; yours or 

   I'm not certain that I understand the question. 
   The policy decision needed is at the home agent
   and that's whether it should authorize the use of
   a particular home address with a given credential.
   I think this is the same requirement for each proposal
   which IKE will handle as well as IKE handles it :)

	     Mike

---

From: Wenxiao He <[email-masked]>
Date: Tue, 29 Oct 2002 09:58:09 -0800

> Otherwise, we would have to use only one; yours or

In order to keep both options in the same mipv6/ipsec draft, 
there should be no IOP problems between the two options.
A node implementing "verify-by-SPD" should talk smoothly
with a node implementing "verify-by-MIPv6".

I have the same IKE negotiation question as above.

In addition to this, there is one difference between
the packets on the wire for these two methods. The
"verify-by-SPD" method generates packets with different
SPIs, and "verify-by-MIPv6" generates packets with the
same SPI, as far as the packets are for the same MN. It
looks to me a "verify-by-SPD" generated packet can be 
accepted by a "verify-by-MIPv6" implementation, however a
"verify-by-MIPv6" generated packet can NOT be accepted
by the "verify-by-SPD" implementation.

-- 
Wenxiao He