Subject: [mobile-ip] use of aggressive mode

From: [email-masked]
Date: Tue, 4 Feb 2003 10:08:38 +0530

hi,

"If preshared secret authentication is used in IKEv1 between the mobile
node and the home agent then aggressive mode MUST be used."

as far as i know the major difference b/w aggressive mode and other modes
is that in aggressive mode messages exchanges are fewer.

then why is this a MUST requirement? it should be that "use of aggressive
mode should be preferred."

regards
gaurav

---

From: Jari Arkko <[email-masked]>
Date: Tue, 04 Feb 2003 08:06:34 +0200

> mode should be preferred."

The number of messages was not the consideration we were thinking of.

The alternatives in IKE for shared secret authentication are main
mode and aggressive mode. But where main mode is used, the only thing
that can be used to determine the shared secret to use is the IP
address of the incoming connection, since the identity of the peer
comes in a later message. Aggressive mode, however, reveals the
identity in an earlier message so that the right shared secret can
be determined. This is important since the IP address of the peer
says nothing for HA-MN IKE, given that care-of addresses are used.

That's why aggressive mode is a practical necessity in this case
IF shared secret authentication is used.

Jari

---

From: Francis Dupont <[email-masked]>
Date: Tue, 04 Feb 2003 11:32:23 +0100

=> no, there is another difference for pre-shared secret authentication.

=> because in main mode the identity payloads are exchanged after the
pre-shared secret is used, so the pre-shared secret is searched using
the peer IP addresses. In a mobile context this implies a "wildcard"
pre-shared secret as the MN care-of address cannot be known in general
in advance. BTW this was explained in this list and in the draft...

Regards

[email-masked]