Subject: RE: [mobile-ip] MIPv6 IPSec database entries

From: "Greg O'Shea" <[email-masked]>
Date: Wed, 8 Jan 2003 18:05:42 -0000

I was concerned that the text says I "MUST" write SPD entries in a way
that may not be possible on some implementations. Why impose specific
constraints on the way a an SPD is written? Is it not enough for an
implementation to protect the messages that need protection?

>-----Original Message-----
>From: Jari Arkko [mailto:[email-masked]] 
>Sent: 08 January 2003 15:03
>To: Greg O'Shea
>Cc: [email-masked]
>Subject: Re: [mobile-ip] MIPv6 IPSec database entries
>
>
>Greg O'Shea wrote:
>>   "As described earlier, the Binding Update and Binding 
>Acknowledgement
>>    messages require protection between the home agent and the mobile
>>    node.  These messages and the return routability messages 
>employ the
>>    same protocol from the point of view of the security 
>policy database,
>>    the Mobility Header." [10.4.4]
>> Mobility Header is not an IPSec protocol.
>
>Right. s/same protocol/same payload protocol/.
>
>> "The security policy database entries MUST be
>>    defined as if they were specifically for the tunnel 
>interface between
>>    the mobile node and the home agent.  That is, the policy 
>entries are
>>    not generally applied on all traffic on the physical 
>interface(s) of
>>    the nodes, but rather only on traffic that enters the 
>tunnel.  This
>>    makes use of per-interface security policy database entries [4],
>>    specific to the tunnel interface (the node's attachment to the
>>    tunnel [11])." [10.4.4]
>> 
>> Disagree. For example if you look at the IPSec implementation in 
>> Windows
>> XP you'll see that its ESP tunnel do not explicitly go via a tunnel 
>> interface, in which case the existing text doesn't make any sense.
>
>I believe the text refers to the plain IPv6 encapsulation 
>tunnel (RFC 2473), not the ESP tunnel. So your IPsec policies 
>apply to this tunnel interface, but if they actually say 'use 
>ipsec' for a particular packet then this packet may have to go 
>the ESP tunnel.
>
>Were you concerned due to the above being unclear, or are you 
>concerned about the reliance on tunnel-specific SPD entries?
>
>Jari
>
>

---

From: Jari Arkko <[email-masked]>
Date: Fri, 10 Jan 2003 17:56:43 +0200

> implementation to protect the messages that need protection?

Yes it is. But the text says "The security policy database entries
MUST be defined _as if_ they were specifically for the tunnel
interface ... ". So we don't require you to do it this way, as
long as the result is the same. Is this enough or did you want
more?

Jari