Subject: RE: [Mip6] question: SA update in dynamic keying scenario

From: "Shinta Sugimoto (TO/NRJ)" <[email-masked]>
Date: Sat, 27 Nov 2004 03:38:24 +0800

Hello Francis,

Please find my further comments inline.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]]
> Sent: Friday, November 26, 2004 10:29 PM
> To: Shinta Sugimoto (TO/NRJ)
> Cc: [email-masked]'
> Subject: Re: [Mip6] question: SA update in dynamic keying scenario 
> 

...[snip]...

>    BTW, assuming that MIPv6 is totally responsible for 
> updating SPD/SADB
>    when the MN performs movement, I wonder what would the benefit of
>    supporting K-bit be ?
> 
> => with IKEv1 K=1 is fine for rekeying: when K=0 the idea is to have a
> short phase 1 in order to just setup the needed SAs. When K=1 
> the phase 1
> can be kept as it is reusable in the long term.

Ok.  It makes sense to use relatively long lifetime of ISAKMP SA in case
of K=1.

> With IKEv2 IPsec SAs are managed and the IKE SA should be long term so
> K=1 is really needed (i.e., it is no more a marginal optimization).

Could you please elaborate more on this ?  Why K-bit becomes more
important in IKEv2 ?

> BTW to implement K=1 is very easy: IKE should keep a correct image of
> the SPD so when the SPD/SAD is updated IKE should be noticed 
> by a message.
> In this message IKE can get the info (i.e., all the addresses).

Ok.  The "message" seems to be the key.

>    Is it just for saving bytes of message exchanges
>    required for phase 1 negotiation ?
> 
> => it is a bit more. Phase 1 adds a lot of delay, a movement can occur
> just at the bad time, etc. In fact K=1 simply gives more reliable
> operations.

What I wanted to point out was that phase 1 negotiation (when K=0)
puts no impact (in terms of delay and # of packet loss) on traffic
which goes through the IPsec tunnel established between the MN and HA.
If K=0, phase 1 negotiation should be run right after the movement.
If K=1, phase 1 negotiation is run only when rekeying is required.
In both cases, during the phase 1 negotiation the (tunnel mode) IPsec SA
should be still valid, which means that traffic which goes through the
IPsec tunnel is not affected by the incidents.  So, I tend to think that
advantage of K-bit is minimized overhead of IKE in terms of bandiwidth
consumption.  Am I missing something?

>    It seems to me that K-bit capability
>    does not improve latency nor minimize packet drop during 
> the movement.
>    Is my understanding correct?
>    
> => if you reduce movement to home registration you're right. But MIPv6
> is supposed to be more.

I hope I've already covered the issue you imply.

Regards,
Shinta

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6