Subject: [Mobike] comments on draft-ike-mobike-design-03.txt

From: Shinta Sugimoto <[email-masked]>
Date: Mon, 29 Aug 2005 21:39:11 +0900

Hello,

I read draft-ike-mobike-design-03.txt and had a few comments/questions
as below:

Technical Comments:

- Section 4, fourth paragraph, it says "Using this API, the MOBIKE
  daemon can create entries in the Security Association (SAD) and
  Security Policy Databases (SPD)." I believe "this API" refers to
  PF_KEY which is initially designed as an interface to SAD. So, the
  draft should be accurate in this respect, IMHO.
- (In Section 5.1) Is my understanding correct that the three
  alternatives presented here could be exclusively used to indicate
  support for MOBIKE ? Or use of "critical" flag in the payload header
  is encouraged in every attempt of sending MOBIKE specific messages ?
- Section 5.8 (Scope of SA changes), I think this is very important
  issue. Separate management of IKE SA and IPsec SA in terms of address
  update allows us more flexible and (potentially) user-friendly
  operation although there will be more complexity and overhead to
  do so.

Editorial Comments:

- Section 3.1, second paragraph, s/statufu/stateful/
- Page 19, first bullet, last sentence, s/it/is/
- Section 5.6, page 20, second bullet,
  s/in order provide/in order to provide/
- Section 5.6, 3rd paragraph, first sentence,
  s/an IP addressed/an IP address/
- Section 5.6, 3rd paragraph,
  s/weaker guarantees then/weaker guarantees than/
- Section 5.6, 5th paragraph (page 21),
  s/material.A protection/material. A protection/
- Page 22, second bullet, first sentence, unnecessary
  "()" appears.
- Section 5.9, 2nd sentence, s/the it/it/

Regards,
Shinta

_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Mon, 29 Aug 2005 15:08:02 +0200

In your previous mail you wrote:

   Technical Comments:

=> PF_KEY can't offically be used to manage the SPD so IMHO the
current wording should be kept.

=> I agree on both: it is an important issue and the current decision is bad.

Regards

[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Shinta Sugimoto <[email-masked]>
Date: Tue, 30 Aug 2005 21:49:35 +0900

On Mon, 29 Aug 2005 15:08:02 +0200

> current wording should be kept.

That's the point that I wanted to make. The current texts could be read
in a way that both SADB and SPD can be accessed by the API (PF_KEY).

   Figure 3 shows an example protocol interaction between a pair of
   MOBIKE peers.  MOBIKE interacts with the IPsec engine using the
   PF_KEY API [RFC2367].  Using this API, the MOBIKE daemon can create
   entries in the Security Association (SAD) and Security Policy
   Databases (SPD).

So just thought that it would be bettter to say:

   Figure 3 shows an example protocol interaction between a pair of
   MOBIKE peers.  MOBIKE interacts with the IPsec engine using certain
   API.  PF_KEY [RFC2367] can be used by the MOBIKE daemon to access
   the Security Association Database (SAD).

Regards,
Shinta