Subject: Re: [MOBILE-IP] WG Last Call: Mobile IPv6:draft-ietf-mobileip-ipv 6-13.txt

From: Richard Draves <[email-masked]>
Date: Tue, 28 Nov 2000 10:07:47 -0800

I think the draft needs to be quite clear about the allowable packet header
arrangements and what addresses in which headers get used for security
policy checks. Being wishy-washy about what the packets can look like will
be very bad for interoperability.

Yes, IKE negotiation or manual configuration could choose between the use of
AH or ESP, besides choosing the specific transforms.

Rich

> -----Original Message-----
> From: Charles E. Perkins [mailto:[email-masked]]
> Sent: Tuesday, November 28, 2000 7:53 AM
> To: [email-masked]
> Subject: Re: [MOBILE-IP] WG Last Call: Mobile
> IPv6:draft-ietf-mobileip-ipv6-13.txt
>
>
> Hello folks,
>
> Is it really acceptable to strip out all the mandates for
> authentication
> methods, and just make a blanket statement that authentication is
> necessary without saying how to do it?  Perhaps the need for having
> a common method (for interoperability) is already mandated just by
> the fact that IPv6 mandates implementation of AH and ESP.  We already
> don't say how the keys are to be distributed.  Presumably the same
> method that causes the keys to be distributed would also determine
> whether AH or ESP is to be used.
>
> If that can be represented as working-group consensus, I will go about
> the process of making a new draft revision for Mobile IPv6.  I don't
> see any technical reason standing in the way of this approach, but
> before making the revisions I hope someone will tell me if it has
> some problems that I don't see right now.  Or, alternatively, that
> more people would express a technical confidence that relaxing the
> restrictions is O.K.
>
> I wonder if this can be considered to be a clarification suggested
> by comments received during Last Call, or whether instead a new
> working group Last Call would have to be issued.
>
> Regards,
> Charlie P.
>
>
>
> Jean-Michel COMBES wrote:
> >
> > Hi,
> >
> > Richard Draves a ecrit :
> >
> > > I have two main issues with draft-ietf-mobileip-ipv6-13.txt.
> > >
> > > 1. The draft is very clear & unambiguous (which is good)
> about the IPsec
> > > headers, but I still respectfully disagree. Mandating AH
> to protect Binding
> > > Updates is too restrictive.
> >
> > JMC :
> > I agree that's too restrictive perhaps.
> >
> > > It is quite feasible to allow for either AH or
> > > ESP.
> >
> > JMC :
> > Agree,
> > - AH/transport
> > or
> > - ESP/tunnel (with null encryption)
> >
> > > In recent discussions of this on the ipsec list, a couple
> other people
> > > (Henry Spencer [[email-masked]], Markku Savela
> > > [[email-masked]]) have agreed with me
> on this point.
> >
> > JMC :
> > Perhaps, it would be better just to say in the draft that
> BU and BAck MUST be
> > authenticated without specifying how, everyone choosing his
> policy (see above).
>

---

From: Francis Dupont <[email-masked]>
Date: Tue, 28 Nov 2000 22:14:44 +0100

In your previous mail you wrote:

=> I agree.

=> my concern is in some cases policies won't be compatible and IKE
(or manual configuration) won't be able to detect this, ie. it will fail
and we shall have to read kilobytes of logs in order to understand
what happened.
IMHO we should have a written down reasonable default, with the current
(previous?) proposal it should be AH transport mode for everything between
MN and CN (ie. any protocol (and port)).

Regards

[email-masked]