Subject: [mobile-ip] RE: Sub:Internet Draft : Using IPsec to protect MobileIPv6 signalling...

From: "Hema Krishnamurthy" <[email-masked]>
Date: Tue, 14 Jan 2003 16:42:32 -0700

Jari,

Based on the previous change of text, this section might need to be changed too?

5.19 Movement and Dynamically Established Security Associations

The text reads ..
"Step 8. Mobile node sends a Binding Update and receives a Binding Acknowledgement using the security associations created in Step 3. The home agent modifies the endpoint of the security associations created in Step 5 to the care-of address C. The home agent and the mobile node will also remove their Phase 1 connection created on top of the care-of address B. 

Step 9. Optionally, the mobile node establishes a new IKE Phase 1 on top of the care-of address C. 

Step 10. The mobile node uses the security associations created in Step 5 to run return routability. The home agent will be able to send the Home Test messages back to the mobile node, because the gateway address was changed to C in Step 8. "

Suggestion :

"Step 8. Mobile node sends a Binding Update and receives a Binding Acknowledgement using the security associations created in Step 3. The home agent MAY modify the endpoint of the security associations created in Step 5 to the care-of address C, or act as if the gateway address of a security association towards the mobile node would have changed . The home agent and the mobile node will also remove their Phase 1 connection created on top of the care-of address B. 

Step 9. Optionally, the mobile node establishes a new IKE Phase 1 on top of the care-of address C. 

Step 10. The mobile node uses the security associations created in Step 5 to run return routability. The home agent will be able to send the Home Test messages back to the mobile node, because either 
1. the gateway address might have been changed to C in Step 8. 
2. else the packet would have been modified after it has gone though IPsec processing.

Hema

-----Original Message-----
From: Jari Arkko [mailto:[email-masked]]
Sent: Tuesday, January 14, 2003 4:06 PM
To: Hema Krishnamurthy
Subject: Re: Sub:Internet Draft : Using IPsec to protect MobileIPv6
signalling...

Hema Krishnamurthy wrote:
> Sounds great ! But
> 
> ". What is needed is that the home agent must be capable
> of changing the gateway address of a security association towards the
> mobile node. "
> 
> Is this line required? Because the HA NEED NOT have the ability to change the gateway addr of the SA?

Right. Sorry about that. I changed to 'as if' language. See web
for new text, report back if there are problems.

Jari

---

From: Jari Arkko <[email-masked]>
Date: Wed, 15 Jan 2003 02:47:59 +0200

> Based on the previous change of text, this section might need to be changed too?

Yes, I didn't get that far yet...

> 2. else the packet would have been modified after it has gone though IPsec processing.

Thanks.

I have decided to have two sections, one for the case where rekeying is
needed, and one for the case where IKE endpoints too can be moved.
Newest draft version on the web, see

   http://www.piuha.net/~jarkko/publications/mipv6/drafts/mipv6haipsec.html#anchor25
   http://www.piuha.net/~jarkko/publications/mipv6/drafts/mipv6haipsec.html#anchor26

Jari