Subject: RE: [mobile-ip] Concern over draft-team-mobileip-mipv6-sec-reqts- 00.txt

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 31 Jul 2001 00:37:47 +0200

Mike, 

While you're answering question (or someone else who knows
IPsec better than me), are there any problems foreseen with IPsec
if we simply get rid of piggybacking the BUs and send them
in separate packets ?
I thought not, but would like some confirmation. 

Thanks,
Hesham

> -----Original Message-----
> From:	Michael Thomas [SMTP:[email-masked]]
> Sent:	Monday, 30 July 2001 10:58
> To:	[email-masked]
> Subject:	RE: [mobile-ip] Concern over draft-team-mobileip-mipv6-sec-reqts-  00.txt
> 
> Glenn Morrow writes:
>  > Michael,
>  > 
>  > You may have a point but please do us the favor of answering these
>  > questions:
>  > 
>  > 1> Do you believe that the credentials associated with an SA for node
>  > mobility would ALWAYS be the same as the credentials for another SA for an
>  > application on two communicating hosts?  
> 
>    Not always. Sometimes though (maybe often even).
>   
>  > 2> Can there be more than one ESP header in a single IP packet without
>  > tunneling?
> 
>    Not to my knowledge.
>  
>  > 3> Has there been any succesful work at changing the answer to question 2 or
>  > perhaps defining some new generic multi-purpose IP-layer encryption option
>  > perhaps with different properties?
> 
>    Not to my knowledge.
> 
>  >  > 4> Has there been any successful work at changing the fact that a BU can be
>  > sent in the same packet as an application PDU?
> 
>    Not sure what you're asking here... Are you asking if there's
>    been an implementation of piggybacked BU's?
> 
> 	   Mike

---

From: Michael Thomas <[email-masked]>
Date: Tue, 31 Jul 2001 07:50:03 -0700 (PDT)

> I thought not, but would like some confirmation. 

   I believe that if you remove the constraint that only
   BU's be protected (vs other destination options), then
   no, I don't think there's a problem. Even if you could
   do such a thing, I'm having a very hard time imagining
   _why_ you would want to do such a thing. Indeed, if
   you used ESP instead, you'd get better protection in
   all cases (assuming you're not using ESP-NULL, of course).

	     Mike