Subject: [Mobike] Scope of SA change in design document..

From: Mohan Parthasarathy <[email-masked]>
Date: Thu, 10 Nov 2005 14:17:54 -0800 (PST)

Section 5.3 of the design document discusses about the
scope of SA change i.e whether it should change all
the SAs or some of the SAs and how packet formats
would be different for these cases.

I think there is a bigger issue here. You can't have
one SA and have multiple flows/packets going over
different paths because if their path charecterestics
are different, the replay check would drop the
packets. Unless ESP can maintain per-address
sequence numbers, how this would be possible.
Perhaps this could be mentioned as a design point.
I don't remember whether this was discussed before
or not.

-mohan

P.S: This issue came up in monami6 discussion
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Thu, 10 Nov 2005 23:45:35 +0100

In your previous mail you wrote:

=> to be more specific: the Monami6 WG explictely asked the issue 8
to be reopened. The minutes are not yet available but the Jabber logs
should show me at the micro just asking this and Vijay's answer (sure).

Regards

[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 11 Nov 2005 20:16:29 +0200

> I don't remember whether this was discussed before

Actually that is not problem with issue 8. The issue 8 is about moving
only part of SAs created between two hosts. One SA always will use
exactly one address pair regardless of issue 8. Our charter do rule
out load balancing, i.e. using multiple addresses at the same time for
single IPsec SA is explicitly ruled out for the group.

We do already offer a way for the host to create separate group of SAs
which are moved separately from each other, i.e. applications can
create multiple IKE SAs, and create the IPsec SAs to the IKE SA having
similar IPsec SAs. I.e. if you have 3 different groups of IPsec SAs
wanting to have different charasteristics from the interfaces uses,
you can create 3 IKE SAs and create those IPsec SAs inside each of
those IKE SAs. Then you have 3 groups (IKE SAs) which you can
separately move from one address pair to another.

You can even move the IPsec SAs from one group to another, by
recreating the IPsec SA in diffenet IKE SA and then deleting the old
IPsec SA from old IKE SA.

The problem with ESP sequence numbers comes only if we try to do
load-balancing, i.e. use multiple different ip-addresses for the SAME
IPec SA at the same time. 
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 11 Nov 2005 20:25:37 +0200

> should show me at the micro just asking this and Vijay's answer (sure).

I checked the Jabber logs, but couldn't really find out if they are
asking for using multiple address pairs for single SA simultaneously
(load balancing ==> out of charter of mobike), or if it is issue 8,
which is having multiple IPsec SAs inside one IKE SA, and wanting to
move them separately from each other without creating multiple IKE
SAs.

Need to wait for the minutes then.... 
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Mohan Parthasarathy <[email-masked]>
Date: Fri, 11 Nov 2005 13:30:19 -0800 (PST)

> single IPsec SA is explicitly ruled out for the
I never mentioned issue 8 and monami6 does not know
anything about MOBIKE issues :-)

> IPec SA at the same time. 

My only poiny is about the design document where
one can explain this motivation. I never asked
to reopen any issues. I agree that one can use
multiple SAs for different flows. I don't think
the discussion in monami6 went that far. So,
my intention was just to explain this in the
design document.

-mohan

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 14 Nov 2005 11:59:51 +0200

> my intention was just to explain this in the

So you want the design document to explain why load balancing was left
out from the charter? I am not really sure why it should be there, as
it is already clear from the charter that we are not going to do that.
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Mon, 14 Nov 2005 11:48:50 +0100

=> so we agree the issue 8 is not out of the charter.

=> this, to have to create multiple IKE SAs between the same peers,
is exactly we'd like to change (including in Monami6 WG concern).

Regards

PS: note there are at most two issues to solve to support this:
 - choose between either sending the message using the "new" address
   or adding a new field for the "new" address.
   (the first is a simplest extension of the current style).
 - a place to put the list of SAs to update.
For the second IMHO an update payload is better.
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Mon, 14 Nov 2005 11:51:49 +0100

=> it is issue 8, each flow uses one tunnel.

=> the Monami6 stuff is in the Mobike charter (as people understood
the question they knew also the charter :-).

Thanks

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 14 Nov 2005 15:01:29 +0200

> => so we agree the issue 8 is not out of the charter.

If it would be out of charter, then it wouldn't be in the issue list
at all, as it would be non-issue... :-)

But it is closed and will not be opened as far as I have understood.

> is exactly we'd like to change (including in Monami6 WG concern).

The working group decided that it is not a concern to create mutliple
IKE SAs and did close issue 8. Thus there is no reason to restart the
discussion about this same issue again here. 
-- 
[email-masked]
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: Francis Dupont <[email-masked]>
Date: Mon, 14 Nov 2005 14:19:25 +0100

=> there is a reason: an explicit request from the Monami6 WG.
As it is in the charter of Mobike IMHO the only thing the Monami6 WG
can do is this request. Now Monami6 people can raise a concern at
the last call for the design document and/or ask for a transfer of
this point between WGs' charters. BTW the Monami6 WG is supposed
to address real world concerns so I don't believe the Mobike WG
should ignore the message...

Regards

PS: the document to read is Vijay's presentation. I have a private copy
of it if it is no more available at the IETF site.
_______________________________________________
Mobike mailing list
[email-masked]
https://www.machshav.com/mailman/listinfo.cgi/mobike

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 14 Nov 2005 18:42:32 -0800

> it is already clear from the charter that we are not going to do that.

I re-read issue 8 and section 5.3. I realized that they are not related :-)
I don't think any changes are needed in the design document.

-mohan