Subject: Re: [MOBILE-IP] [Fwd: Re: [MOBILE-IP] New version of "MobilitySup port in IPv6"draft]

From: Glenn Morrow <[email-masked]>
Date: Sun, 22 Oct 2000 10:32:22 -0500

> Consider the case where a CN/Home Agent receives a BU. The packet could be
> like this
>
>         IPv6 header, HA dest hdr, AH, BU dest hdr, TCP hdr.
[[gm]]  consider this:

        IPv6 header, HA dest hder, AH, BU dest hdr, SIP Invite

How does one know whether the authenitication parameters related to the
binding update are the same as the parameters related to the SIP Invite or
for that matter - any application?

Are we making some assumptions here about business models that perhaps we
shouldn't?

Is it possible to have more than one AH header with different checksum
boundaries?

---

From: Francis Dupont <[email-masked]>
Date: Mon, 23 Oct 2000 09:36:21 +0200

In your previous mail you wrote:

=> I don't understand the last statement (AH covers the whole packet)
then I don't understand the issue here...

Regards

[email-masked]

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 23 Oct 2000 08:05:53 -0700

Hello Glenn,

You asked:

> binding update are the same as the parameters related to the SIP Invite or for
> that matter - any application?

AH is for _network layer_ binding.

It does not give any assurance that application is authorized
to offer the services or interactions peculiar to that application.
If there is a way for an application to get installed on a host
that it should not be running on, then that application _can_
"subvert" the network-layer security infrastructure.

Does this answer your question?

> Are we making some assumptions here about business models that perhaps we

The distance between business models and network-layer security
is farther than I can usefully comprehend.

> Is it possible to have more than one AH header with different checksum

Not as far as I know.

Regards,
Charlie P.