Subject: RE: [mobile-ip] 3 pairs of IPSec SA for MN/HA signaling protectio n

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 15 Oct 2002 18:20:23 +0200

> 2 alternatives:
  > 
  > 1. Make all Mobile IPv6 signaling use the same protocol 
  > (the Mobility Header), therefore reducing the number of SA 
  > pairs from 3 to 1.

=> It's only 1 if you assume that the HOTI/HOT will be tunnelled
with an outer header that contains a HAO/RH respectively.
I can't see how else you reached 1 SA. 
So I think you have 2 alternatives in one:
	1a. Carrying the ICMP messages in the routing header will reduce
	    the number of SAs by 1
	1b. Assuming that the HAO/RH will be included in the 
	    outer header of HOTI/HOT will reduce the number of 
	    SAs by 1.

If you do 1a and 1b you reduce the number of SAs to 1.
In 1b) I'm assuming that we can use ESP in transport
mode (on the outer header). 

  > 
  > 2. Allow usage of the Binding Authorization Data option in 
  > all Mobile IPv6 signaling messages, thereby utilizing the 
  > same security relationship for them all regardless of the 
  > different protocols the signaling messages are carried over.

=> This one is a mystery to me, please reveal your trick :)
Seriously, I don't understand how changing names can make
anything easier. Let me elaborate:

To do this you would need to configure the HA/MN with the 
key and MAC algorithm (I know we have only one MAC, but it might change
in future). This configuration command and resulting state kept is new.
You also need to magically create the right SPD entries that 
distinguish a BU message from any other MH. 

If you do all that _and_ still keep your IPsec implementation
and SAs for ICMP/HOTI/HOT messages (or just one SA for all of 
them as you suggest in 1) ), please explain to me what was saved
in terms of:

1. State in the HA/MN
2. Implementation effort/code size

Thanks,
Hesham

---

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 15 Oct 2002 18:31:49 +0200

sorry, one correction.

  > 	1a. Carrying the ICMP messages in the routing header will reduce
                                            ^^^^^^^^^^^^^^
=> Of course it's the mobility header not the RH.

Hesham