Subject: RE: [mobile-ip] Dynamic Home Agent Address Discovery mechanism

From: Mohan Parthasarathy <[email-masked]>
Date: Thu, 19 Jul 2001 11:35:40 -0700 (PDT)

> 
> I completely agree with you and am not against the use of IPsec; on the
> contrary I agree that IPsec should be possible. 
> 
> But it seems that in the last version of the MIPv6  specifiaction, the
> authentication data is embedded in the BU; using AH will therefore be
> redundant.
> 
The draft is not clear about when IPsec would be used and what
these fields in BU would be if IPsec is used. 

Also, section 4.4 does not include the sender's "key". Without, this
it cannot provide sender authentication in the absence of IPsec.
Obviously, you would not need this if IPsec is used.

-mohan

> To come back to the Home agent discovery, that is true that IPsec with
> anycast had not yet been defined, but in that case we do not have to use
> IPsec to secure the ICMP Home Agent address discovery messages: as you
> said, MN and HA can have a pre-established key they will use for
> authentication. Instead of using AH, an authentication data field will
> carry the authentication information.
> 
> -----Original Message-----
> From: ext Hesham Soliman (ERA) [mailto:[email-masked]]
> Sent: 19 July, 2001 8:58 AM
> To: [email-masked]'
> Subject: RE: [mobile-ip] Dynamic Home Agent Address Discovery mechanism 
> 
> 
> > As Mobile IPv6 defines its own built-in security mechanism (please see
> > the Binding Update format of the last version of the draft - section
> > 5.1), we do not have to use IPsec but, in the same way, the ICMP Home
> > Agent address Discovery Request message could embed some own specific
> > security mechanism.
> > 
> 	=> I believe IPsec is needed and will work for the HA. 
> 	 The problems highlighted for MIPv6 / IPsec are not really
> 	applicable for the HA. In particular the key exchange mechanism.
> 	This can be preconfigured in the MN. Strong authentication 
> 	to the HA should be supprted IMHO. 
> 
> 	Hesham

---

From: Michael Thomas <[email-masked]>
Date: Thu, 19 Jul 2001 11:47:58 -0700 (PDT)

Indeed. The way the draft reads right now, there
would need to be a separate IKE DOI which I'll
assume wasn't intended.

	      Mike