Subject: [mobile-ip] open issues for mipv6

From: Jari Arkko <[email-masked]>
Date: Fri, 10 Jan 2003 18:55:14 +0200

I thought I'd try to summarize the open issues in an effort
to close the spec as soon as possible. I promised to deliver it
today in fact, but that may be impossible. But I'd very much like
to do it on the next couple of days. Can we try to close the
issues on the list within the next couple of days?

Here's the summary of the open issues:

202 Adopted? Yes  -      S=0 and authz check

     Greg noticed a problem with S=0 and knowing whether
     the SA would be authorized to carry also BUs for the implied
     home addresses. A lots of ideas have been exchanged, but my
     latest proposal is to require support for
     draft-ietf-ipsec-sctp-04.txt which allows the "list"
     selector type. We could use this for S=0. The draft
     is in IESG review with comments found. Gabriel seems
     to think this approach is riskier than moving the
     S bit functionality to another document.

201 Open     No   -      SPD entry problems from Greg O'Shea

     There are some editorial issues which I can take care of.
     But Greg is also complaining about something else, which
     may either be real or just a textual issue. I think it
     is a textual issue, he thinks we are mandating a specific
     way to write the entries even if we say "must be written
     as if ...".

195 Adopted? Yes  -      MN-HA IPsec: more details on IKE processing

     I posted detailed text. Some discussion remains, see
     also 194 below.

194 Adopted? Yes  -      MN-HA IPsec: more details for tunnel end-point changes

     I posted detailed text. We noticed that we need to move
     IKE endpoints as well, and there's a debate on whether we
     can mandate an API for this. Perhaps the API should be optional,
     but details need to be worked out.

     A second part of this issue is whether to mandate a specific
     profile of IKE to use or not... the tradeoff is interoperability
     vs. freedom.

192 Rejected?No   -      MN-HA IPsec: authorization in SPD or MIPv6?

     The basis is that we could in theory do this. The new approach
     is pretty good. Its quite unproven, however. So I'm leaning
     on a reject here, on the basis of not jumping on new stuff
     late in the project ;-)

189 Adopted? Yes  20     Results of the security review

     Luis Sanchez et al have reviewed our specification
     and sent some comments.

     We are adding required text for better RR justification,
     and a number of smaller modifs.

     They'd like IKE to be made mandatory; I'm opposing this
     after talking to a number of folks (yes I know you Francis
     agree with Luis).

     Then we have been debating whether to talk only about ESP
     and leave AH out of the documents. The current compromise
     is to talk about ESP in the documents and examples, but
     not forbid AH.

184 Open     No   -      S bit unclarities from Greg O'Shea

     This is a tricky one. We have discussed this in fact under
     #202 lately. The compromise suggestion was to make S=0 optional
     for MNs. Will this be acceptable to you Greg? Note that
     given #202, S=0 requires heavier integration between ipsec,
     ike, and mipv6 on the HA side than before.

Links:

   http://www.piuha.net/~jarkko/publications/mipv6/MIPv6-Issues.html
   http://www.piuha.net/~jarkko/publications/mipv6/drafts/mobilev6.html
   http://www.piuha.net/~jarkko/publications/mipv6/drafts/mipv6haipsec.html