Subject: [MOBILE-IP] comment on IKE in Mobile IPv6

From: Yoshihiro Ohba <[email-masked]>
Date: Thu, 14 Dec 2000 22:50:51 -0500

Hi,

I have a comment regarding IKE in MIPv6 environment.

In section 10.2 of the MIPv6 draft it is stated that:

--------------------------------------------------------------------
    -  The mobile node MUST use its care-of address as the Source
       Address of all packets it sends as part of the key management
       protocol (without use of Mobile IP for these packets, as
       suggested in Section 10.1).

    -  In addition, for all security associations bound to the mobile
       node's home address, the mobile node MUST include an ISAKMP
       Identification Payload [14] in the IKE exchange, giving the
       mobile node's home address as the initiator of the Security
       Association [22].
--------------------------------------------------------------------

However, consider the case in which a mobile node is performing IKE
with a correspondent node which is also a mobile node.

If care-of address is used as the Source Address for packets carrying
IKE messages without using Mobile IP, the packets may not be delivered
if both nodes change their care-of addresses at the same time.

So I think at least Mobile IP should be used for IKE between a mobile
node and a correspondent node (and the mobile node and correspondent
node should not perform IKE before the mobile node is successfully
registered to its Home Agent.)

Or am I missing something?

Yoshihiro Ohba
Toshiba America Research, Inc.

---

From: Dave Johnson <[email-masked]>
Date: Thu, 14 Dec 2000 23:48:04 -0600

>In section 10.2 of the MIPv6 draft it is stated that:

This is not necessary, since in the worst case, a home agent in
the mobile node's previously visited network would forward packets
addressed to the mobile node's previous care-of address to the
mobile node's new care-of address, after the mobile node moves.
See Section 10.9 of the draft.

                                        Dave

---

From: Yoshihiro Ohba <[email-masked]>
Date: Fri, 15 Dec 2000 06:54:02 -0500

From: Dave Johnson <[email-masked]>
Subject: Re: [MOBILE-IP] comment on IKE in Mobile IPv6
Date: Thu, 14 Dec 2000 23:48:04 -0600

> See Section 10.9 of the draft.

Thank you for the response.

It implies that in the worst case, a mobile node may need to perform
IKE with the visiting network's home agent before doing IKE with a
correspondent node.

If such kind of IKE-for-IKE is not preferable, we could also consider
to have an option to use Mobile IP (based on tunneling between a
mobile node and its original(?) home agent) for IKE between a mobile
node and a correspondent node, in order to improve the worst case
behavior.

Yoshihiro Ohba

---

From: Francis Dupont <[email-masked]>
Date: Fri, 15 Dec 2000 18:57:35 +0100

In your previous mail you wrote:

=> this is the double movement problem, It is solved by the fallback
mechanism to the unoptimized version of mobile IPv6:
 - packets are sent to the home address via a care-of address using
   a routing header
 - the care-of address is too old, ie. unreachable, so ICMP errors
   are returned back or some kind of timeout occurs
 - the sender discovered the binding cache entry is wrong, it flushes
   it and goes though the home agent.
The only annoying event is to change the care-of address before IKE
exchanges are finished.

=> it is critical to use the care-of address for the IKE with the Home
Agent but not for other correspondents. If the mobile node uses its
home address and the correspondent has already a binding (valid binding
but expired SAs) then the correspondent must flush the binding as
the first step. This is expensive too... There are some trade-offs
but the current specification is simpler, perhaps we should change
to a MUST for home agent and a SHOULD for other correspondents.
I don't personally believe possible gains are enough for the
complexity (ie. I'd like to apply the KISS principle :-).

=> one point is not clear: if the initiator mobile node uses
its care-of address, it knows only the home address of its peer
then the problem is not symmetrical (and you can get two independent
IKEs in the same time then four SAs).

Regards

[email-masked]

---

From: Yoshihiro Ohba <[email-masked]>
Date: Mon, 18 Dec 2000 14:03:32 -0500

From: Francis Dupont <[email-masked]>
Subject: Re: [MOBILE-IP] comment on IKE in Mobile IPv6
Date: Fri, 15 Dec 2000 18:57:35 +0100

>    it and goes though the home agent.

Yes, I agree with this solution is valid for IKE packets sent from
Initiator to Responder, since the Responders' home address can be used
as the destination address for those packets.

> The only annoying event is to change the care-of address before IKE

Yes, this issue also should be solved.

> Agent but not for other correspondents. If the mobile node uses its

Exactly speaking, it is mandatory to use the care-of address for the
IKE with the Home Agent only when no security association yet exists
between the mobile node and Home Agent, but not for other cases.  In
other words, if there is already a security association between the
mobile node and Home Agent and IKE is performed between them for
updating keys, then home address could be used.

> complexity (ie. I'd like to apply the KISS principle :-).

I think more detailed description that focuses on IKE in MIPv6 and
covers all possible scenarios is needed, and agree with Mohan
Parthasarathy to have an informational draft.

> IKEs in the same time then four SAs).

Although I don't like the asymmetrical case,
Cookie fields in ISAKMP header and/or Identification Payload in ISAKMP
payload could be used to avoid creating the independent IKEs for
such kind of asymmetric cases.

> [email-masked]

Regards,
Yoshihiro Ohba