Subject: [mobile-ip] the K bit.

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 16 Jan 2003 18:25:47 -0800

hi Jari,

we need some more text for the K bit in the base spec.

in section 6.1.7
 
>    Key Management Mobility Capability (K)
> 
>       If this bit is reset, the protocol used for establishing the IPsec
>       security associations between the mobile node and the home agent
>       does not survive movements.  It may then have to be rerun.  (Note
>       that the IPsec security associations themselves are expected to
>       survive movements.)

add
        This bit is valid only in Binding Updates sent to the Home
Agent.
        Correspondent nodes should ignore this bit. If manual IPsec 
        configuration is used, the bit MUST be set to 1.

and in section 6.1.8

>    Key Management Mobility Capability (K)
> 
>       If this bit is reset, the protocol used by the home agent for
>       establishing the IPsec security associations between the mobile
>       node and the home agent does not survive movements.  It may then
>       have to be rerun.  (Note that the IPsec security associations
>       themselves are expected to survive movements.)

add
        Correspondent nodes MUST set the K bit to 0.

in section 11.7.1 (Sending Binding Updates to the Home Agent)

> 
>    o  If the home address was generated using RFC 3041 [17], then the
>       link local address is unlikely to have a compatible interface
>       identifier.  In this case, the mobile node MUST clear the
>       Link-Local Address Compatibility (L) bit.

after the above text, add

o  If the mobile node has the capability to update the IKE Phase 1 
   endpoint to the new care-of address everytime it moves, it SHOULD
   set the K bit. Otherwise the mobile node MUST clear the bit.

similar text is needed for the HA when it sends a binding ack. 
ofcourse if the K bit is 0 in the binding update, the HA has to 
set it to 0 in the binding ack.

Vijay

---

From: Jari Arkko <[email-masked]>
Date: Sat, 18 Jan 2003 19:45:01 +0200

>         configuration is used, the bit MUST be set to 1.

'1' conflicts with your text for the MN behaviour below.

>    set the K bit. Otherwise the mobile node MUST clear the bit.

I'll fix the text as follows:

     o  If the IPsec security associations between the mobile node
        and the home agent are established dynamically, and
        the mobile node has the capability to update its endpoint
        in the used key management protocol to the new care-of
        address every time it moves, the mobile node SHOULD set the
        K bit in the Binding Update. Otherwise, the mobile node
        MUST clear the bit.

Jari

---

From: Jari Arkko <[email-masked]>
Date: Sat, 18 Jan 2003 21:29:35 +0200

We need some additional text for the behaviour to discuss
what needs to be done based on the K bit, not just its
settings.

Here's the 10.3.1 (home agent, home reg) text:

    o  The Key Management Mobility Capability (K) bit is set if the
       following conditions are all fulfilled, and reset otherwise:

       *  The Key Management Mobility Capability (K) bit was set in the
          Binding Update.

       *  The IPsec security associations between the mobile node and the
          home agent have been established dynamically.

       *  The home agent has the capability to update its endpoint in the
          used key management protocol to the new care-of address every
          time it moves

       Depending on the final value of the bit in the Binding
       Acknowledgement, the home agent SHOULD perform the following
       actions:

       K = 0

          Discard key management connections, if any, to the old care-of
          address.  If the mobile node did not have a binding before
          sending this Binding Update, discard the connections to the
          home address.

       K = 1

          Move the peer endpoint of the key management protocol
          connection, if any, to the new care-of address.  For an IKE
          phase 1 connection, this means that any IKE packets sent to the
          peer are sent to this address, and packets from this address
          with the original ISAKMP cookies are accepted.

and the 10.3.2 (home agent, de-reg) text:

    o  The Key Management Mobility Capability (K) bit is set or reset,
       and actions based on its value are performed as described in the
       previous section.  The mobile node's home address is used as its
       new care-of address.

and the 11.7.1 (mobile node, home reg) text:

    o  If the IPsec security associations between the mobile node and the
       home agent have been established dynamically, and the mobile node
       has the capability to update its endpoint in the used key
       management protocol to the new care-of address every time it
       moves, the mobile node SHOULD set the K bit in the Binding Update.
       Otherwise, the mobile node MUST clear the bit.

and the 11.7.3 (mobile node, receiving ba) text:

    If the acknowledgement came from the home agent, the mobile node
    examines the value of the Key Management Mobility Capability (K) bit.
    If this bit is not set, the mobile node SHOULD discard key management
    protocol connections, if any, to the home agent.  The mobile node MAY
    also initiate a new key management connection.

    If this bit is set, the mobile node SHOULD move its own endpoint in
    the key management protocol connections to the home agent, if any.
    The mobile node's new endpoint should be the new care-of address.
    For an IKE phase 1 connection, this means packets sent to this
    address with the original ISAKMP cookies are accepted.