Subject: RE: [mobile-ip] Preconfigured Kbm between mobile node and corresp ondent

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Fri, 25 Oct 2002 18:27:54 +0200

> A couple of weeks ago, there was discussion about allowing
  > a correspondent node and mobile node to use a preconfigured
  > binding key (Kbm).  The specification does seem to support
  > this mode of operation, and various issues (e.g., replay)
  > were discussed with, I think, positive resolution.
  > 
  > The only clarification that I think is needed is that for
  > preconfigured binding keys, the Nonce Indices option is
  > truly optional.
  > 
  > I have asked Jari to post the following:
  > 
  > Issue:	How do mobile nodes and correspondent use 
  > preconfigured Kbm?
  > 
  > Proposal: Eliminate requirement for Nonce Indices option in 
  > this case.

=> Don't you still need a COTI/COT exchange?
I can't think of a secure way of auth BUs 
without COTI. Even if you somehow use IPsec. 

Hesham

---

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 25 Oct 2002 09:42:42 -0700

Hello Hesham,

Preconfigured Kbm between correspondent node and mobile
node does serve to identify the mobile node (in contrast
to Kbm established from return routability).

Plus, one has to remember the threat.  If it is a concern
that zillions of bad hosts would victimize some care-of
address, that is wholly incompatible with the scenario
for preconfiguring Kbm between a particular correspondent
node and mobile node.

Regards,
Charlie P.