Subject: [Hipsec] Draft: ESP usage in HIP

From: [email-masked] (Henderson, Thomas R)
Date: Wed Apr 27 21:43:02 2005

>=20
> I'm working on the next version of the ESP draft. There have=20
> been some comments for and against the HES / HER conseptual=20
> protocols, but not too many.=20

The sentiment that I and another speaker voiced at the WG meeting was to
avoid the HES/HER conceptual protocols.  I have not heard any other
comments in favor of those protocols.

> With the current definition we=20
> could allow the ESP SA establishment also in later phase,=20
> using UPDATE messages.
>=20
> If I have understood correctly, there were not too many=20
> comments related to this issue during last IETF meeting. Any=20
> comments now? Leave it like it is now, or change it so that=20
> the setup is done during base exchange.

Could you explain what you have in mind?  I am reading the above to mean
that data is first sent without ESP, and is later updated to run over an
ESP SA, but perhaps I am not understanding correctly?

Tom

---

From: [email-masked] (Gonzalo Camarillo)
Date: Thu Apr 28 03:23:01 2005

Hello,

>> With the current definition we could allow the ESP SA establishment
>> also in later phase, using UPDATE messages.
>> 
>> If I have understood correctly, there were not too many comments
>> related to this issue during last IETF meeting. Any comments now?
>> Leave it like it is now, or change it so that the setup is done
>> during base exchange.
> 
> 
> Could you explain what you have in mind?  I am reading the above to
> mean that data is first sent without ESP, and is later updated to run
> over an ESP SA, but perhaps I am not understanding correctly?

a use case would be a user moving between different accesses with
different security properties (e.g., from a corporate Intranet to the
public Internet). When the user moves to the new access the transport is
updated from ESP NULL to ESP with encryption.

We would have the same situation when a user moves from a low-bandwitdh
access where SRTP is used to allow for header compression to a
high-bandwidth access where ESP can be used.

Gonzalo

---

From: [email-masked] (Petri Jokela)
Date: Thu Apr 28 03:48:00 2005

> high-bandwidth access where ESP can be used.

If we decide to continue with this model, it might be better to get rid 
of the conseptual way of describing things and put more concrete 
definitions; describe the usage both with Base exchange and UPDATE 
messages. It would make the draft easier to understand.

/petri

-- 
Petri Jokela                        Tel:    +358 9 299 2413
Research scientist                  Fax:    +358 9 299 3535
NomadicLab, Ericsson Research       Mobile: +358 44 299 2413
Oy L M Ericsson Ab                  email: [email-masked]

---

From: [email-masked] (Pekka Nikander)
Date: Fri Apr 29 07:54:01 2005

> If we decide to continue with this model, it might be better to get 
> rid of the conseptual way of describing things and put more concrete 

Sounds very good to me.

--Pekka