Subject: Re: [MOBILE-IP] Security Questions for Mobility in IPv6 Drafts

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Thu, 6 Jul 2000 21:45:03 +1000

I think we should be careful with this case though, because if you
place the
   BU after the ESP header it probably won't work through the
translators.
   Which would impact the V6 <-> V4 communication.

=> I don't believe in a V6 <-> V4 translator with mobility support
(for instance IPv4 source-routing is not available in the today Internet
for many reasons).

I don't really understand what that means. Are you against translators that
support mobility ? I'm not sure how source routing is related to this.

   Yes this is great but placing BU after the IPsec header will be a
problem
   for the migration mechanisms available today.

=> it is a problem for firewalls too. I am in favour of a SHOULD (for
BU in the same header than HA) but we can't sell a MUST here.
I believe the I-D 12 doesn't specify this because to do the right thing
is more simple...

Maybe it should be stated in the relevant translator drafts instead of the
MIPv6 draft ? We have a draft for NGTRANS and this is one of the topics
addressed. Hopefully coming out soon.

Cheers,
Hesham

---

From: Francis Dupont <[email-masked]>
Date: Thu, 6 Jul 2000 19:15:16 +0200

In your previous mail you wrote:

   support mobility ?

=> I am not against translators that support mobility, I just believe it
is not possible for a translator to support mobility (but we have to
define what is to support mobility too :-).

   I'm not sure how source routing is related to this.

=> IPv6 mobility uses source routing and if a translator translates
an IPv6 source route header to an IPv4 source route option the next
router will likely drop the packet on the floor: this doesn't work!

      Yes this is great but placing BU after the IPsec header will be a
   problem for the migration mechanisms available today.

=> if you cannot justify a MUST then the place you put the SHOULD is not
really important... In fact if someone is using ESP (with a real cipher)
then both translators and firewalls will have some problems (you have
to explain how to deal with headers and data which are not in the clear part).

Regards

[email-masked]

PS: in fact I've disliked translators since I proposed to use them for
TUBA. There are too many ugly little details and no good solution for
address translation. I prefer clean design like DSTM!