Subject: Re: [MOBILE-IP] WG Last Call: Mobile IPv6:draft-ietf-mobileip-ipv 6-13.txt

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Wed, 29 Nov 2000 04:00:33 +1100

Hello Charlie,

> > To be able to for an opinion I need to ask a couple of questions
> > about IPsec.
> > I thought that ESP would authenticate everything below the ESP
> > header and not before it ? Is that correct ?
> > If that's not correct then why was AH chosen in the first place ?
>
> As indicated in Jean-Michel's original note, ESP is used in tunnel
> mode, so that the entire inner packet is authenticated.  AH takes
> less space, which is why it was originally chosen.
>
        => I see. I don't have a problem with that as long as the draft
        specifies that the MN follows the normal sending rules.
        Ie. the outer packet contains the Home address option
        and if the CN is a MN for which the MN  (sending th BU)
        has a BC entry, then a routing header should be included as usual.

        Regards,
        Hesham

---

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Wed, 29 Nov 2000 05:55:30 +1100

I thought the main goal was to go to last call ASAP.
So if there is no problem with version 13 do we really
need this new change ?
As Dave says below this may be more complex, so it
might be worth saving this for a bis.

I'd like to see MIPv6 become an RFC one day ;)

Hesham

> -----Original Message-----
> From: Dave Johnson [SMTP:[email-masked]]
> Sent: Wednesday, 29 November 2000 5:31
> To:   [email-masked]
> Subject:      Re: [MOBILE-IP] WG Last Call: Mobile
> IPv6:draft-ietf-mobileip-ipv6-13.txt
>
> >Charlie P.
> No, that is incorrect -- I originally chose only AH, based on input
> from the working group, since use of ESP was even more complicated
> than AH, since ESP only protects the part of the packet below the
> ESP header.  Originally, I worded the draft to allow either,
> stating only what must be protected (not how to use either AH or
> ESP in particular to protect it).  After many requests, however, I
> revised it to specify how to use AH, so that at least some minimal
> common form of authentication was clearly specified to improve
> interoperability.  In particular, only AH in transport mode is
> defined in the draft, since it is the minimal (simplest) form of
> IPsec that does what we need.  AH/tunnel mode, ESP/transport mode,
> and ESP/tunnel mode can all be done, and I made many suggestions
> about how they could be specified, in presentations at IETF
> meetings and in a presentation at Connectathon in March this year.
>
>                                         Dave