Subject: IPsec and Mobile IPv6

From: Francis Dupont <[email-masked]>
Date: Mon, 27 Jan 2003 11:58:44 +0100

I submitted a new version of my draft about IPsec and Mobile IPv6
(draft-dupont-ipsec-mipv6-02.txt). I am writting a proposal for
an address management feature in IKEv2.

[email-masked]

PS: here is the plan of the proposal. First part is already finished,
I expect to submit it before the end of this week.

Summary of address management for IKEv2

Goals
  General goals
    Simplicity
    Performance (why rekeying is not enough)
    Security
      Transient Pseudo-NAT attack
    Extension of draft 04
      Cleanup of NAT-DETECTION-*-IP notifications
        Hash is not useful
        No way to request
        Multiple address support
      Misused of peer addresses
        IKE SA lookup by SPI
        INITIAL-CONTACT issue
        Revised Identities
      Proxy case support for transport mode
  NAT traversal requirements
    NAT detection (including NAT position)
    Endpoint addresses (for transport checksums in transport mode)
    Three way handshake
  Multi-homing requirements
    Peer address sets
  Mobility requirements
    Strong sequencing of updates
    Fine grain (i.e., per SA) updates
Proposal
  Kept points from draft 04
    Address stability in exchanges (in vs between)
    Peer address specification and role
  Small points
    Proxy case support (for transport mode)
    INITIAL-CONTACT (lookup by Identity)
  Peer address protection
    Address notifications
    Protection request by the responder
    Protection request by the initiator
    Error case(s)
    Address pairing (optional, for multi-homing)
  Implicit address update
    Not for IPsec SAs
    Not for IKE SA
  Explicit address update
    The new notification
    Sequencing requirement
    All SAs short update