Subject: RE: [mobile-ip] observation on the mip/ipsec draft

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 29 Oct 2002 00:23:35 +0100

> > => Note the underlined lines. I don't think the check will be 
  > > in the SPD. The check will be as follows: 
  > > 
  > > - IPsec processing verifies the packet
  > > - MIPv6 module receives the packet from IPsec. 
  > > - MIPv6 module checks the SPI used for this SA
  > > - If (SPI == this_HoA_SPI) accept BU;
  > > so the MIPv6 module needs to know the SPI - HoA mapping
  > > a priori.
  > 
  > Yes, but the text I suggested tried to allow for either
  > implementation technique. That is, either in the SPD or
  > in the MIPv6 module.

=> Ok. Could we add some text to explain how the MIP
code authorises the BU? I think this would help because
Mike's proposal is hinging on this API (to get the SPI)
and the SPI - HoA mapping in the MIP code. 
Or were you planning on clarifying this somewhere else?
As long as it's done somewhere I don't see a problem.

Hesham

---

From: "Hesham Soliman (EAB)" <[email-masked]>
Date: Tue, 29 Oct 2002 00:35:20 +0100

>  >   >    Is there actually any reason to be specific? I'm
  >  >   >    not a fan of AH, but I don't believe that AH
  >  >   >    would require any more SA's. Both ESP and AH
  >  >   >    provide integrity protection, so they both meet
  >  >   >    the requirement as far as I can tell.
  >  > 
  >  > => Well, you can't use AH for payload traffic (typically)
  >  > or HOTI/HOT. So if you use AH for the rest, you will need
  >  > to SAs instead of one.
  > 
  >    AH does payload traffic... remember
  >    historically there didn't even used to be an
  >    ESP!

=> Yes, but I was thinking of when confidentiality is 
needed. Anyway, HOTI/HOT need confidentiality. 

Hesham

  > 		Mike