Subject: Re: [MOBILE-IP] WG Last Call: Mobile IPv6:draft-ietf-mobileip-ipv 6-13.txt

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Wed, 29 Nov 2000 03:17:07 +1100

Hello Charlie, 

If I understand you correctly, you're saying we should allow 
either ESP or AH. And that since IPv6 supports both
then there shouldn't be an interoperability problem. 

To be able to for an opinion I need to ask a couple of questions 
about IPsec. 
I thought that ESP would authenticate everything below the ESP
header and not before it ? Is that correct ?
If that's not correct then why was AH chosen in the first place ?

If ESP can authenticate the entire packet then I don't see 
a problem with your suggestion, but I'd like to know why
AH was chosen over ESP. 

Regards,
Hesham

> -----Original Message-----
> From: Charles E. Perkins [SMTP:[email-masked]]
> Sent: Wednesday, 29 November 2000 2:53
> To:   [email-masked]
> Subject:      Re: [MOBILE-IP] WG Last Call: Mobile
> IPv6:draft-ietf-mobileip-ipv6-13.txt
> 
> Hello folks,
> 
> Is it really acceptable to strip out all the mandates for authentication
> methods, and just make a blanket statement that authentication is
> necessary without saying how to do it?  Perhaps the need for having
> a common method (for interoperability) is already mandated just by
> the fact that IPv6 mandates implementation of AH and ESP.  We already
> don't say how the keys are to be distributed.  Presumably the same
> method that causes the keys to be distributed would also determine
> whether AH or ESP is to be used.
> 
> If that can be represented as working-group consensus, I will go about
> the process of making a new draft revision for Mobile IPv6.  I don't
> see any technical reason standing in the way of this approach, but
> before making the revisions I hope someone will tell me if it has
> some problems that I don't see right now.  Or, alternatively, that
> more people would express a technical confidence that relaxing the
> restrictions is O.K.
> 
> I wonder if this can be considered to be a clarification suggested
> by comments received during Last Call, or whether instead a new
> working group Last Call would have to be issued.
> 
> Regards,
> Charlie P.
> 
> 
> 
> Jean-Michel COMBES wrote:
> >
> > Hi,
> >
> > Richard Draves a écrit :
> >
> > > I have two main issues with draft-ietf-mobileip-ipv6-13.txt.
> > >
> > > 1. The draft is very clear & unambiguous (which is good) about the
> IPsec
> > > headers, but I still respectfully disagree. Mandating AH to protect
> Binding
> > > Updates is too restrictive.
> >
> > JMC :
> > I agree that's too restrictive perhaps.
> >
> > > It is quite feasible to allow for either AH or
> > > ESP.
> >
> > JMC :
> > Agree,
> > - AH/transport
> > or
> > - ESP/tunnel (with null encryption)
> >
> > > In recent discussions of this on the ipsec list, a couple other people
> > > (Henry Spencer [[email-masked]], Markku Savela
> > > [[email-masked]]) have agreed with me on this point.
> >
> > JMC :
> > Perhaps, it would be better just to say in the draft that BU and BAck
> MUST be
> > authenticated without specifying how, everyone choosing his policy (see
> above).

---

From: "Charles E. Perkins" <[email-masked]>
Date: Tue, 28 Nov 2000 08:33:27 -0800

Hello Hesham,

> then there shouldn't be an interoperability problem.

Correct.

> If that's not correct then why was AH chosen in the first place ?

As indicated in Jean-Michel's original note, ESP is used in tunnel
mode, so that the entire inner packet is authenticated.  AH takes
less space, which is why it was originally chosen.

Regards,
Charlie P.

---

From: Dave Johnson <[email-masked]>
Date: Tue, 28 Nov 2000 12:30:48 -0600

>less space, which is why it was originally chosen.

No, that is incorrect -- I originally chose only AH, based on input
from the working group, since use of ESP was even more complicated
than AH, since ESP only protects the part of the packet below the
ESP header.  Originally, I worded the draft to allow either,
stating only what must be protected (not how to use either AH or
ESP in particular to protect it).  After many requests, however, I
revised it to specify how to use AH, so that at least some minimal
common form of authentication was clearly specified to improve
interoperability.  In particular, only AH in transport mode is
defined in the draft, since it is the minimal (simplest) form of
IPsec that does what we need.  AH/tunnel mode, ESP/transport mode,
and ESP/tunnel mode can all be done, and I made many suggestions
about how they could be specified, in presentations at IETF
meetings and in a presentation at Connectathon in March this year.

                                        Dave

---

From: Francis Dupont <[email-masked]>
Date: Tue, 28 Nov 2000 21:12:46 +0100

In your previous mail you wrote:

=> it is more by compromise than for interoperability (:-)!

=> yes that is (and you do know this :-).

=> just because that is correct.

=> the home address should be before the IPsec header(s) because:
 - this works with any IPsec implementation on the receiving side
   (don't forget the receiving side is the general one then the complexity
    if you can't avoid it should be on the sending side)
 - this is (very) firewall friendly. I don't like firewalls (I prefer IPsec)
   but I believe we may not in the same time propose something which
   bypass ingress-filtering (the home address option) and make it totally
   firewall unfriendly (ie. suggest to hide it behind an ESP).
I'd like to get the firewall people opinion at the IETF last call...

Regards

[email-masked]

---

From: Francis Dupont <[email-masked]>
Date: Tue, 28 Nov 2000 21:24:39 +0100

=> and as most IPsec implementations check the (outer) source address
then ESP in tunnel mode doesn't work (even if RFC 2401 5.1.2.1 3- NOTE
suggests explicitely this should not cause a problem). The AH solution
is far more easier for inbound IPsec processing, this is enough to
retain it for first specs.

PS: the problem with ESP should be addresses as soon as possible because
if the current proposal for mobility is more efficient than tunnelling,
if there are already tunnels it has a large and unjustified overhead...

---

From: AIme Le-Rouzic <[email-masked]>
Date: Wed, 29 Nov 2000 18:00:07 +0100

> I'd like to get the firewall people opinion at the IETF last call...

I think draft13 is good like it is because it allows
vendors to offer solutions for those mobile users who
only want authentication because the AH transport mode
and solutions for those mobile users who want to also
cipher datas by having the AH+ESP transport mode.

It allows also administrators to let go through the
border of their intranet the mobile packets by having
the Home address option in front  of the ESP header.
Without being able to control them, the network
administrators  will block and good bye mobile users.

The draft13 allows to show the interest of MobileIPv6
and then IPv6 that MobileIPv6 should boost.

Best regards.

--
     ________________________Aime LEROUZIC____________________________
     BULL S.A ECHIROLLES FRANCE      mailto:[email-masked]
     http://www-frec.bull.com                tel: +33 (0)4 76 29 75 51
     Communications TCPIP                     http://intranet/lerouzic