Subject: RE: [mobile-ip] Dynamic Home Agent Address Discovery mechanism

From: [email-masked]
Date: Thu, 19 Jul 2001 08:52:18 -0500

As Mobile IPv6 defines its own built-in security mechanism (please see
the Binding Update format of the last version of the draft - section
5.1), we do not have to use IPsec but, in the same way, the ICMP Home
Agent address Discovery Request message could embed some own specific
security mechanism.

-----Original Message-----
From: ext Michael Thomas [mailto:[email-masked]]
Sent: 18 July, 2001 12:47 PM
To: [email-masked]
Subject: RE: [mobile-ip] Dynamic Home Agent Address Discovery mechanism 

[email-masked] writes:
 >  Of course the use of a router on a network as an HA
 > definitely requires strong authentication in the BU. Is there any
reason
 > why the same authentication requirements be not available for the
 > discovery message? 

   There's no way to use IPsec to secure an anycast.

   What you're proposing is non-trivial which is why
   it needs a pretty significant amount of justification.

	    Mike

---

From: Michael Thomas <[email-masked]>
Date: Thu, 19 Jul 2001 07:16:09 -0700 (PDT)

> Agent address Discovery Request message could embed some own specific

  1) The current draft does not specify any mechanism so it's
     impossible to tell whether it's an appropriate mechanism
     for HA discovery. I wouldn't make that assumption.
  2) The HA/MN security association should be able to use IPsec
     as before; the problem was the selector for multiple IP
     level protocol headers when piggyback BU's to CN's. Use of
     AH or ESP to the HA (see draft-thomas-mobileip-esp-bu-00.txt)
     with a single BU in the packet should work fine with existing
     IPsec implementations that support normal 5-tuple selectors.
     (ie, are 240[7-9] compliant).
  3) I really don't understand why the draft put in a BU SA field,
     or the authdata field since there is no consensus on that and
     the requirements draft was just published. Nor do I see why
     the current draft needs to state requirements in section 4.4

		 Mike