Subject: [mobile-ip] SPI in rfc3344

From: Mauro Tortonesi <[email-masked]>
Date: Fri, 4 Oct 2002 13:18:30 +0200 (CEST)

i have a question about the use of SPI in Mobile IPv4. rfc3344 does not 
state how the SPI and the Mobility Security Association are achieved.

it does only specify that a Mobility Security Association is:

   A collection of security contexts, between a pair of nodes,
   which may be applied to Mobile IP protocol messages
   exchanged between them.  Each context indicates an
   authentication algorithm and mode (Section 5.1), a secret (a
   shared key, or appropriate public/private key pair), and a
   style of replay protection in use (Section 5.7).

my question is: how is this Mobility Security Association established?

i suppose that the preferred method for establishing Mobility Security 
Associations is ISAKMP/IKE, but there isn't a single reference to IPSEC, 
ISAKMP or IKE in the whole rfc3344. perhaphs am i missing something?

i also suppose that the secret between the Home Agent and the Mobile Node 
should be known before the first Registration Request, so that the
Home Agent can be sure that the host sending Registration Request messages
is indeed the Mobile Node. what's the implementations' preferred mechanism 
to achieve this? PKI? preconfigured shared secret keys?

-- 
Aequam memento rebus in arduis servare mentem...

Mauro Tortonesi			[email-masked]
				[email-masked]
Ferrara Linux User Group	http://www.ferrara.linux.it
Project6 - IPv6 for Linux	http://project6.ferrara.linux.it

---

From: Mauro Tortonesi <[email-masked]>
Date: Fri, 4 Oct 2002 19:26:30 +0200 (CEST)

> my question is: how is this Mobility Security Association established?

excuse me. stupid question. from rfc3344 section 3.6:

   A mobile node MUST be configured with a netmask and a mobility
   security association for each of its home agents.

however, i still guess that Foreign-Home and Mobile-Foreign Mobility 
Security Association are established using ISAKMP/IKE. is this true?

Mauro Tortonesi			[email-masked]
				[email-masked]
Ferrara Linux Users Group	http://www.ferrara.linux.it
Project6 - IPv6 for Linux	http://project6.ferrara.linux.it

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 07 Oct 2002 08:21:41 -0700

Hello Mauro,

> Security Association are established using ISAKMP/IKE. is this true?

Presumably, these could be created using the extensions
specified in the AAA keys draft.  IKE is also possible,
I reckon.

> Aequam memento rebus in arduis servare mentem...

My best Latin expired 30 years ago, so I can't get
a good sense of what this means.  Probably my
current translation would be a howler.

Regards,
Charlie P.