Subject: Re: [MOBILE-IP] Security Questions for Mobility in IPv6 Drafts

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Thu, 6 Jul 2000 18:42:27 +1000

The binding update can be after or before the home address option
and any IPsec header, in the same or a different destination option
header than the home address.

I think we should be careful with this case though, because if you place the
BU after the ESP header it probably won't work through the translators.
Which would impact the V6 <-> V4 communication.

PS: for instance in my code (which works with IPsec and negociates
SA with IKE) you get:

IPv6 header:
 src = care-of address
 dst = home agent address
Dest-option header:
 Binding Update
 Home Address (with the home address)
Auth-header (with SPI for mobile home address -> home agent address SA)
No-next-header (empty)

Yes this is great but placing BU after the IPsec header will be a problem
for the migration mechanisms available today.

---

From: Francis Dupont <[email-masked]>
Date: Thu, 6 Jul 2000 11:32:36 +0200

=> I don't believe in a V6 <-> V4 translator with mobility support
(for instance IPv4 source-routing is not available in the today Internet
for many reasons).

=> it is a problem for firewalls too. I am in favour of a SHOULD (for
BU in the same header than HA) but we can't sell a MUST here.
I believe the I-D 12 doesn't specify this because to do the right thing
is more simple...

Regards

[email-masked]