Subject: [mobile-ip] (non-technical) Support for draft-team-mobileip-mipv6-sec-reqts-00.txt

From: Charlie Perkins <[email-masked]>
Date: Sun, 29 Jul 2001 07:20:43 -0700

Hello folks,

This note is intended to reaffirm my support for the recent
security draft, but does not contain any additional technical
proposals or suggestions.

The security requirements draft reaches a number of conclusions
about what is needed to make sure that Mobile IPv6 is secure.
I believe that the conclusions are largely correct, and my private
conversations and e-mails with some of the authors would
make that clear.  The corrections and suggestions contained
in my previous e-mail was not intended to derogate the findings
of the abovementioned draft, since I largely agree with them.

Unfortunately, a previous message to this mailing list claimed
otherwise, and as co-author and document editor for the
Mobile IPv6 draft, I feel that it is very important for my support
for this document to be clearly understood.  I believe that all of
the vulnerabilities in the document need to be understood, and
the vulnerabilities specific to Mobile IPv6 need to be countered
within the Mobile IPv6 specification.

One exception is that I suggested a MUST should be a SHOULD,
and so on, but this does not amount to lack of support for the
document, nor any wholesale dispute with its findings, nor any
attempt on my part to soft-peddle reality.  The main point of my
previous note was to urge the authors to restate certain introductory
discussion points (not the eventual findings) so that it would be
clear that Mobile IPv6 already DOES address one of the very
important potential vulnerabilities discussed within the report.

I have been stressing over this for over a day now and it seems
to me that since I have the responsibility for revising the Mobile
IPv6 document, and since the requirements document will be
used to determine further revisions, I have to be sure that interested
parties within the working group understand that I do support the
analysis offered within the security requirements document, and the
process (albeit seemingly slow) by which that document can be used
to make progress.

Regards,
Charlie P.