Subject: RE: [Mipshop] rfc4068bis - MAC Mobility Option for FBU/FBAckprotection

From: "Vijay Devarapalli" <[email-masked]>
Date: Fri, 16 Jun 2006 13:56:45 -0700

> ok. but I still maintain that the key exchange mechanism
> decides which authentication algorithm is used. not the
> option. for example take the case of IPsec. the algorithm
> to be used is not carried in the ESP header. the SPI points
> to the security association which in turns tells you what
> key and algorithm to use.
> 
> jak>> Both the SEND and AAA handover key signaling has fields 
> to specify 
> what authentication algorithm to use. 

I assume both mechanisms create some security state that
includes the key and the algorithm to be used. 

> This is for the FMIP 
> signaling to 
> indicate which algorithm the key exchange mechanism specified.

you shouldn't have to indicate it again in FMIP 
signaling. the security state that was created
above will tell you which key and algorithm to 
use.

> > That is the
> > whole point of this. And, the SPI is used only for the
> > AAA-based method
> > to index the key - in the SEND case, the key is indexed by
> > the CoA alone
> > and the SPI is set to 0.
> 
> this is weird. SPI should be used in the SEND case too.
> 
> jak>> Why? The SPI is a key name, in SEND it is specified by 
> the CoA. Is 
> there some advantage to using it in SEND too?

traditionally SPI (32 bits) has been used to look
the SA. not sure why SEND based FMIPv6 keys spec
says set the SPI to zero and use the CoA to index
the security associations.

Vijay

>             jak 

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "James Kempf" <[email-masked]>
Date: Fri, 16 Jun 2006 14:35:48 -0700

jak>> Yes, that's right. SEND uses the CoA to index the state.

jak>> Because the CoA or SPI indicates which one to use?

jak>> Well, the purpose of the secassoc is to authorize messages changing a 
particular IP address. So it seemed logical to use the IP address as the 
index for the secassoc rather than another SPI. The identity is determined 
by the public key, and, through the CGA property, the address.is used to 
index.

jak>> The difference with the AAA method (and why it needs an SPI) is 
because it ties the identity to the NAI and derives an SPI to index.

            jak

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 16 Jun 2006 15:28:27 -0700

> jak>> Because the CoA or SPI indicates which one to use?

YES.

> jak>> Well, the purpose of the secassoc is to authorize messages 
> changing a particular IP address. So it seemed logical to use the IP 
> address as the index for the secassoc rather than another SPI. The 
> identity is determined by the public key, and, through the CGA property, 
> the address.is used to index.
> 

got it.

Vijay