Subject: Re: [MOBILE-IP] WG Last Call: Mobile IP v6:draft-ietf-mobileip-ip v6-13.txt

From: Richard Draves <[email-masked]>
Date: Tue, 21 Nov 2000 15:23:23 -0800

I have two main issues with draft-ietf-mobileip-ipv6-13.txt.

1. The draft is very clear & unambiguous (which is good) about the IPsec
headers, but I still respectfully disagree. Mandating AH to protect Binding
Updates is too restrictive. It is quite feasible to allow for either AH or
ESP. In recent discussions of this on the ipsec list, a couple other people
(Henry Spencer [[email-masked]], Markku Savela
[[email-masked]]) have agreed with me on this point.

2. The draft is insufficiently clear about the interactions between Mobile
IPv6 and IPsec policy (SPD) and IKE negotiations. I think there's very
little chance that two implementations of this draft would interoperate out
of the box because of this. (If two implementors get together and jointly
configure their policy databases, I think this problem can be overcome. But
that's not very satisfactory for deployment.) See my mail of the last couple
days on this topic for more detail.

Rich

> -----Original Message-----
> From: Roberts Philip-qa3445
> [mailto:[email-masked]]
> Sent: Tuesday, November 21, 2000 7:28 AM
> To: [email-masked]
> Subject: [MOBILE-IP] WG Last Call: Mobile IP
> v6:draft-ietf-mobileip-ipv6-13.txt
>
>
> Folks,
>
> This is a Mobile IP WG last call for the I-D
> draft-ietf-mobileip-ipv6-13.txt - Generalized NAI Extension
> (GNAIE). This draft will be sent to the IESG requesting a proposed
> standard status to be associated with it at the end of the last call
> period. Please send your comments to the WG discussion list.
>
> Although the draft has been submitted to the Internet
> Directory it has not
> appeared on the website yet.  In the meantime it can be viewed at:
> http://www.diameter.org/charliep/txt/mobilev6/mobilev6.txt
>
> WG Last call issued on : Nov 21, 2000
> Expires on : December 8, 2000
>
> Basavaraj Patil
> Phil Roberts
>

---

From: Jean-Michel COMBES <[email-masked]>
Date: Wed, 22 Nov 2000 14:38:22 +0100

Hi,

Richard Draves a écrit :

> Updates is too restrictive.

JMC :
I agree that's too restrictive perhaps.

> It is quite feasible to allow for either AH or
> ESP.

JMC :
Agree,
- AH/transport
or
- ESP/tunnel (with null encryption)

> In recent discussions of this on the ipsec list, a couple other people

JMC :
Perhaps, it would be better just to say in the draft that BU and BAck MUST be
authenticated without specifying how, everyone choosing his policy (see above).

Regards.

--

France Telecom R&D - DTL/SSR
Jean-Michel COMBES, Internet/Intranet Security
E-Mail : [email-masked]
Phone +33 (0)1 45 29 45 94, Fax +33 (0)1 45 29 65 19
PGP fingerprint : 07C6 37BF 4DE5 1CE1 EEB1 1F13 5D75 9E33 CFA7 0214

---

From: "Charles E. Perkins" <[email-masked]>
Date: Tue, 28 Nov 2000 07:53:15 -0800

Hello folks,

Is it really acceptable to strip out all the mandates for authentication
methods, and just make a blanket statement that authentication is
necessary without saying how to do it?  Perhaps the need for having
a common method (for interoperability) is already mandated just by
the fact that IPv6 mandates implementation of AH and ESP.  We already
don't say how the keys are to be distributed.  Presumably the same
method that causes the keys to be distributed would also determine
whether AH or ESP is to be used.

If that can be represented as working-group consensus, I will go about
the process of making a new draft revision for Mobile IPv6.  I don't
see any technical reason standing in the way of this approach, but
before making the revisions I hope someone will tell me if it has
some problems that I don't see right now.  Or, alternatively, that
more people would express a technical confidence that relaxing the
restrictions is O.K.

I wonder if this can be considered to be a clarification suggested
by comments received during Last Call, or whether instead a new
working group Last Call would have to be issued.

Regards,
Charlie P.

---

From: Dave Johnson <[email-masked]>
Date: Tue, 28 Nov 2000 12:10:23 -0600

>whether AH or ESP is to be used.

Charlie,

That is exactly the way I used to have the draft worded -- for
exactly the reasons now being discussed.  However, the strong
consensus that developed seemed to be (at the time) that the draft
must be specific on how to use IPsec.  And the consensus (again, at
the time) seemed to be that it was possible to define how to use
ESP, but relative to AH, use of ESP was quite messy due to the
differences in what parts of the packet are protected by AH
vs. ESP.  The thinking was that use of ESP could be added later,
but that we wanted to get some version to Last Call and Proposed
Standard ASAP, so the draft only specified use of AH, and only
specified transport mode, not tunnel mode.  It is certainly
possible to define all the other combinations, but I think it is
also still important to reach closure soon on at least some version
of this and get it through the IESG.

                                        Dave

--
David B. Johnson, Associate Professor
of Computer Science and Electrical and Computer Engineering

Department of Computer Science - MS 132    [email-masked]
Rice University                            http://www.cs.rice.edu/~dbj/
6100 Main Street                           Phone: (713) 348-3063
Houston, Texas 77005-1892 USA              Fax:   (713) 348-5930

---

From: "Charles E. Perkins" <[email-masked]>
Date: Tue, 28 Nov 2000 10:35:33 -0800

Hello Dave,

Thanks for your note.  I don't wish to make an arbitrary
decision in this matter, so I am trying to gauge working
group consensus.

I agree with you about the need to reach closure soon.

I'm very much hoping someone will make it clear to me about
whether to make the change, because that's a good idea that
represents consensus, or instead to not make the change,
because we don't need to and it's time to get it to IESG.

I'm happy either way.

Regards,
Charlie P.

---

From: Dave Johnson <[email-masked]>
Date: Tue, 28 Nov 2000 12:43:21 -0600

Charlie,

As noted in my note :-), the working group consensus has already
been gauged in the past on exactly this issue that you are raising
again now, which is exactly why I previously changed the draft from
the way I had it to the way it is now.  The question you are
raising is whether we should reverse that consensus and go back to
the way I had the draft before.  I belive the consensus at the time
was to be specific about how to use IPsec, and the consensus I see
coming in now I think is saying the same thing.

                                        Dave

---

From: Francis Dupont <[email-masked]>
Date: Tue, 28 Nov 2000 21:01:19 +0100

In your previous mail you wrote:

   Is it really acceptable to strip out all the mandates for authentication
   methods, and just make a blanket statement that authentication is
   necessary without saying how to do it?

=> this will just make the specifications not usable.
IMHO the specs should describe a solution (AH which is known to work)
and let others (ESP, tunnel stuff) for further studies.
We should go to IESG ASAP!

   Perhaps the need for having
   a common method (for interoperability) is already mandated just by
   the fact that IPv6 mandates implementation of AH and ESP.  We already
   don't say how the keys are to be distributed.

=> this is not true, there are some clever statements about how to use IKE
in order to establish security associations (then keys).

   Presumably the same method that causes the keys to be distributed
   would also determine whether AH or ESP is to be used.

=> this will work if (quote IPsec) IKE is used as a policy enforcement
protocol and not a policy negociation protocol but this should give
major interoperability problems...

   If that can be represented as working-group consensus, I will go about
   the process of making a new draft revision for Mobile IPv6.

=> I don't believe to add again six months to the date for mobile IPv6
avaibility is a good move (nor someone will get a consensus in favor
of this :-).

Regards

[email-masked]

---

From: Francis Dupont <[email-masked]>
Date: Tue, 28 Nov 2000 22:18:01 +0100

=> I couldn't say that in a better way!

Thanks!!!