Subject: [MOBILE-IP] Security Questions for Mobility in IPv6 Drafts

From: Glenn Morrow <[email-masked]>
Date: Wed, 5 Jul 2000 12:52:50 -0500

Excuse me but can the binding update option be encrypted for security
purposes?

If not, do people feel it should be?

If so, would IPv6 security have to be altered in some way or do people
believe there should be some encryption that is option specific?

---

From: Francis Dupont <[email-masked]>
Date: Wed, 5 Jul 2000 23:33:01 +0200

In your previous mail you wrote:

=> it may but there is an issue if the home address option (which
must be in the same packet) is encrypted because the security association
should use it.

=> the only thing which has to be altered is the recommended order
of IPv6 extension headers: ESP must be after the destination option
header which carries the home address. The constraints are:
 - the home address option must be before any IPsec header
   (then tunnel mode doesn't work)
 - there must be an AH header with anti-replay
The binding update can be after or before the home address option
and any IPsec header, in the same or a different destination option
header than the home address.

[email-masked]

PS: for instance in my code (which works with IPsec and negociates
SA with IKE) you get:

IPv6 header:
 src = care-of address
 dst = home agent address
Dest-option header:
 Binding Update
 Home Address (with the home address)
Auth-header (with SPI for mobile home address -> home agent address SA)
No-next-header (empty)