Subject: [MOBILE-IP] draft-ietf-mobileip-ipv6-09 comments about HA or COA for SA establishment

From: AIme Le-Rouzic <[email-masked]>
Date: Tue, 1 Feb 2000 12:00:43 +0100

Hi, Dave

   In a common project with INRIA (Francis Dupont's code),
 France Telecom and Bull we are experimenting Mobile IPv6 and
 IPSEC.

   We have a problem to configure / establish the security
 associations(SA).
   The issue was raised by Itojun and Francis Dupont but is not
 yet fixed in the I-D (draft-ietf-mobileip-ipv6-09.txt).
   (Do we have to use care-of-address (COA) or home address
 (HA) as SA selectors?)

   If we do with the COA address, every time the mobile moves a
 new SA will have to be established.
   If we do with the HA address, it will not work if the
 destination with the HA option header is placed behind of the
 ESP if both authentication and encryption are used.

   Could the next I-D precise to put the HA destination option
 in front of the security header like the routing header is. In
 transport mode, which is the mode the mobile host uses, the
 user will be able to protect data by encryption.

   What is the difficulty with that?
   In that case,  we will be able to access the HA address when
 ESP is used in transport mode.

   The HA header could still be authenticated (useful for
 integrity).
   It will simplify the Mobile IPv6 implementation and
 useability. The HA address will be  available for Firewalls
 and other configuration mechanisms.

   It should help Mobile IPv6 to be more successful by helping
 the user to securize his data what it will want to do when
 outside his home network.

   Best regards.

PS:
   Dave, I let you forward this mail to other lists if
 necessary(ipsec, ipng).

--
     ________________________Aime LEROUZIC____________________________
     BULL S.A ECHIROLLES FRANCE      mailto:[email-masked]
     http://www-frec.bull.com                tel: +33 (0)4 76 29 75 51
     Communications TCPIP                     http://intranet/lerouzic