Subject: RE: [mobile-ip] IPsec, IKE, MIPv6 and concensus

From: [email-masked]
Date: Tue, 21 Aug 2001 13:04:47 +0300

Hesham wrote:
> > > >    Of course both A and B rely on eliminating piggybacking 
> > > of the BUs. 
> > > >    
> > > > => Yeh!
> > > > 
> > 
> > This is not true at all. There is always the case when 
> there is no IPsec SA
> > required for the payload itself and there would be 
> absolutely no harm done
> > by piggybacking. Only when the payload and the BU need 
> different SAs could
> > piggybacking not be done.
> > 
> 	=> Yes but you can't design a standard that only works 
> sometimes. 
> 

The scenario is: 

- Need to send a BU to a CN
 - If there is an outgoing packet to the CN in a queue, and 
  - the packet is not associated with any SA
  - then can piggyback the BU with the packet in the queue
 - else send BU as a separate packet

If the spec allowed for this, would it be broken in some way?

Sure this is a performance optimization only, and the degree of the benefit
depends heavily on the type of L2's in both ends, feature interaction with
HC, etc., but if done right there is nothing that would make the standard
"only work sometimes". It is quite customary that standards have options
that are not always used.

Additionally, you would not need to implement this, if you don't want. The
recipient would need to be able to process piggybacked BUs, but for that
no-one needs to do *anything*, if there is a e.g. a separate next header
value for the BU etc. Not a single line of code required.

If Mobile IP signaling stays in the network layer headers, the standard
actually does not need to state anything about piggybacking. It would _just
work_, if implemented? That is, unless the spec. actually mandates NO
transport layer stuff after the Mobile IP header.

So it seems that it would suffice for the spec to state if transport level
stuff is allowed after the Mobile IP header(s) or not.

	Jarno

---

From: [email-masked]
Date: Tue, 21 Aug 2001 12:58:11 +0000

> Jarno wrote:

But what will happen if at a later time it becomes necessary to have 
a SA also for the payload? IPSec will detect, that there is already 
one (with no idea, that it has been established for Mobile IP BUs), 
which probably will not match the security policy for the payload. So 
should the Mobile IP SA be overridden? How do you inform Mobile IP 
about that? 

You won't have such problems without piggybacking.

> stuff is allowed after the Mobile IP header(s) or not.

Wolfgang

---

From: Alexis Olivereau <[email-masked]>
Date: Tue, 21 Aug 2001 13:54:31 +0200

> should the Mobile IP SA be overridden? How do you inform Mobile IP

There is an idea I suggested a few weeks ago... We may want to solve
that issue creating new algorithm numbers for IPsec, let's say MIP-SHA1
and MIP-MD5. Those algorithms would be considered as "very week" by
IPsec policy management entity, so when a security association is to be
established with a peer from which a BU has already been received, the
SA parameters will be renegociated.

Alexis.

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 21 Aug 2001 17:28:46 +0200 (CEST)

> If the spec allowed for this, would it be broken in some way?

Someone (I forgot who) pointed out that even this was a problem for 
careful implementations of IPsec.
The claim (which I understand and agree with) is that
a TCP connection would like to use the same security policy for the lifetime
of the connection. If you don't then how can you use IPsec to prevent 
a unsecure RST packet from blowing away your connection?

Thus if the packet is piggyback on a TCP SYN packet the peer
is likely to assume that all of that TCP connection will be secured,
but that will not be the case since the SYN was only secured as a site effect
of securing the piggy-backed BU.

I don't know if there are similar issues for the reverse case when
the connection starts off not being protected by IPsec and later a single
TCP packet is protected by IPsec.

> that are not always used.

But such options are a possible source of interoperability problems ...

  Erik