Subject: [mobile-ip] Any other security other than IPSec?

From: "Tan, Tat Kin" <[email-masked]>
Date: Sat, 2 Aug 2003 14:17:22 +0800

Hello,

Would like to know if anyone had ever consider to implement or had any idea to use other security measurements in mipv6 instead of the much talked IPSec?

While the draft indicated most of the communications SHOULD use IPSec, such as during binding, i was thinking performance would be a huge factor under processing bandwidth hunger area such as real time voice processing.

anyone any idea?

thanks in advance.

rgds,
tatkin

---

From: Jari Arkko <[email-masked]>
Date: Sun, 03 Aug 2003 11:21:00 +0300

> Would like to know if anyone had ever consider to implement or had any idea to use other security measurements in mipv6 instead of the much talked IPSec?

Yes. Some folks have worked with the use of Binding Authorization Data option,
for instance, to secure even BUs to the home agent.

> While the draft indicated most of the communications SHOULD use IPSec, such as during binding, i was thinking performance would be a huge factor under processing bandwidth hunger area such as real…

In terms of per-packet processing requirements, other security mechanisms
would probably be in the same class; authentication, replay protection,
and confidentiality services are needed in any case.

But IPsec has limitations in the area of requiring specific security
policies, which can be troublesome especially if you want to have
dynamically allocated (e.g. RFC 3041) home addresses.

Going forward and looking at the new features as a part of the planned
MIP6 WG work, we need to address these concerns. As was discussed
in IETF-57, alternatives for this include coming up with something
IKEv2 based or using an "application" (Mipv6) layer solution.

--Jari

---

From: Uri Blumenthal <[email-masked]>
Date: Mon, 04 Aug 2003 12:31:07 -0400

On 8/2/2003 2:17 AM, Tan, Tat Kin wrote:
> Hello,
> 
> Would like to know if anyone had ever consider to implement or had any
> idea to use other security measurements in mipv6 instead of the much
> talked IPSec?
> While the draft indicated most of the communications SHOULD use IPSec,
> such as during binding, i was thinking performance would be a huge
> factor under processing bandwidth hunger area such as real time
> voice processing.

IPsec provides two things:

1. Establishes session keys for the traffic.
2. Authenticates and/or encrypts every traffic packet.

First - what makes you think that performance on a per-packet basis
will suffer by "a huge factor"? Do you have any numbers...?

Second - if you abolish IPsec but decide you still need security,
you will have to perform both of the above steps. Please tell me
what makes you think that doing those things by other-than-IPsec
tool is any faster or easier on performance. (A hint: crypto
operations are the same, crypto algorithms are the same.)