Subject: RE: [Mipshop] 2 more WG LC comments on hmipv6

From: Soliman Hesham <[email-masked]>
Date: Mon, 24 Nov 2003 18:20:51 -0500

> > This section doesn't quite nail the full
 > > mechanism down.  Nevertheless, it assumes that IKE will be used,
 > > although there are issues with it actually working fine (like
 > > using the RCoA as the identity in Phase 2, even though this
 > > configuration would be harder to achieve than currently in
 > > MIPv6 in which the well-known and somewhat static home 
 > address allows
 > > its use as phase 2 identity. I don't think this will be directly
 > applicable to
 > > securing a MAP in which the RCoA will not have anything permanent
 > > with regards to any given MN in particular.  I'm not advocating
 > > solving the full problem, just softening the language a 
 > bit ("it could
 > work
 > > like this...").
 > >
 > 
 > I think this could work with IKEv2, but it would require an 
 > effort on the
 > order of that for draft-ietf-mobileip-mipv6-ha-ipsec-06.txt 
 > to specify it
 > and therefore should be left to MOBOPTS.
 > 
 > As the draft currently stands, however, I agree that it 
 > would essentially
 > require a statically configured RCoA; 

=> I don't think it needs to be statically configured. 
If I understand Gab's comment correctly, he's saying 
that IKE needs to know about the RCoA that the MN picked
in order to use it in Phase 2. I.e. some exchange of information
locally within the MN (and the same in the MAP to verify that
the RCoA is not already allocated to someone else). There is
no research to be done AFAICS, it's an implementation issue. 
Gab please let me know if I misinterpreted your comment. 

Hesham

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: gabriel montenegro <[email-masked]>
Date: Tue, 25 Nov 2003 01:04:33 +0100

> Gab please let me know if I misinterpreted your comment. 

I don't suppose statically configured RCoA's will work. I don't
believe they will be useful to *identify* the MN, so I question
why one would want to use RCoA as the identity in Phase 2.
Not advocating any particular identity to be used, nor am I
sure that IKE is the only way to do this. I'm just saying that
perhaps we shouldn't pretend that we know this will actually
work as written in the text and leave that even more tentative
than in its present form (basically allowing for future work
on MN-MAP security to depart widely from the ha-mn-ipsec
scheme if need be).

-gabriel