Subject: RE: [mobile-ip] MIPv6 - Focus of the security discussion

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Tue, 9 Oct 2001 11:44:56 +1000

Vijay, 

> > Solving the other IPsec issues (that you raise) is required, but lets
> > not get stuck on trying to make MIPv6 work only with IPsec. We could
> > do that as a separate effort. Whether the solution implies no
> > piggybacking, a new next header etc. can be dealt with separately. As
> > long as the non-IPsec solution does not prevent or cause problems in
> > sing IPsec we should go forward in getting that solution done.
> 
> Auth Data Suboption is a very good alternative for securing the BUs.
> lets work on it and move the MIPv6 spec forward.
> 
	=> You've mentioned this a few times now and  think it's 
	misleading at best. Are you suggesting that if we all agreed today
	to go ahead with the Auth data suboption, then the MIPv6
	draft will be ready ? Nothing else to solve for the security
	issues ? No key exchange problem (much bigger than what
	we're discussing now btw) ?

	Hesham

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 08 Oct 2001 19:10:15 -0700

Hi Hesham,

> "Hesham Soliman (EPA)" wrote:
> 
> Vijay,
> 

Auth Data suboption does not solve the key exchange problem. it
solves the problem of how to protect the BU once the keys
have been created between the MN and the CN. it is an alternative
to using AH and ESP. 

The MIPv6 draft talks about how to protect the BU. it does not
talk about the key exchange problem. that is done in a bunch of
drafts (BAKE, SUCV, PBK, Home Agent cookies...). so if we agree
on using the suboption, MIPv6 draft can move ahead.

Thats what I meant. and I did not intend to mislead anyone.
its you and few others who are holding the MIPv6 draft to ransom
by citing that it does not work with AH. So what? if it does not
work with AH, lets move ahead. lets find an alternative solution.

first lets figure out how BU can be protected with the auth data
suboption. (its already there in the draft 15). next lets
figure out how BAKE/AAA/Son of IKE can supply the security 
association. 

and meanwhile, the die-hard AH enthusiasts can figure out how
AH can be used to protect the BU. 

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 08 Oct 2001 19:13:13 -0700

just an additional comment

> figure out how BAKE/AAA/Son of IKE can supply the security

supply to mipv6 module which would then create this suboption.