Subject: Re: [MOBILE-IP] WG Last Call: Mobile IPv6:draft-ietf-mobileip-ipv6-13.txt

From: Mohan Parthasarathy <[email-masked]>
Date: Tue, 28 Nov 2000 09:44:47 -0800

> F >
> Hello folks,
>
> Is it really acceptable to strip out all the mandates for authentication
> methods, and just make a blanket statement that authentication is
> necessary without saying how to do it?  Perhaps the need for having
> a common method (for interoperability) is already mandated just by
> the fact that IPv6 mandates implementation of AH and ESP.  We already
> don't say how the keys are to be distributed.  Presumably the same
> method that causes the keys to be distributed would also determine
> whether AH or ESP is to be used.
>
> If that can be represented as working-group consensus, I will go about
> the process of making a new draft revision for Mobile IPv6.  I don't
> see any technical reason standing in the way of this approach, but
> before making the revisions I hope someone will tell me if it has
> some problems that I don't see right now.  Or, alternatively, that
> more people would express a technical confidence that relaxing the
> restrictions is O.K.
>

If ESP is used you MUST use the alternate care of address option
and the binding update should appear after the ESP header. With this
the restriction can be relaxed to use ESP. If you just say
"authentication required", it will not help the implementors in
anyway.

-mohan

> I wonder if this can be considered to be a clarification suggested
> by comments received during Last Call, or whether instead a new
> working group Last Call would have to be issued.
>
> Regards,
> Charlie P.
>
>
>
> Jean-Michel COMBES wrote:
> >
> > Hi,
> >
> > Richard Draves a écrit :
> >
> > > I have two main issues with draft-ietf-mobileip-ipv6-13.txt.
> > >
> > > 1. The draft is very clear & unambiguous (which is good) about the IPsec
> > > headers, but I still respectfully disagree. Mandating AH to protect Binding
> > > Updates is too restrictive.
> >
> > JMC :
> > I agree that's too restrictive perhaps.
> >
> > > It is quite feasible to allow for either AH or
> > > ESP.
> >
> > JMC :
> > Agree,
> > - AH/transport
> > or
> > - ESP/tunnel (with null encryption)
> >
> > > In recent discussions of this on the ipsec list, a couple other people
> > > (Henry Spencer [[email-masked]], Markku Savela
> > > [[email-masked]]) have agreed with me on this point.
> >
> > JMC :
> > Perhaps, it would be better just to say in the draft that BU and BAck MUST be
> > authenticated without specifying how, everyone choosing his policy (see above).
>