Subject: AW: [Mobopts] Presentation slides for "CXTP using GIST"

From: "Tschofenig, Hannes" <[email-masked]>
Date: Mon, 21 Nov 2005 14:23:14 +0100

hi hui

there are two issues to discuss:

a) which security mechanisms you use for protection of the context transfer between the old ar and the new ar. 

b) which context you transfer between these devices. 

i could not remember xiaoming and john proposing to transfer ipsec sas as part of (b). if you would like to transfer ipsec sas then the past investigations in, for example, <draft-hk-seamoby-ct-ipsec-00.txt> or <draft-gopal-seamoby-ipsecctxt-issues-01.txt> might be worth taking a look. 

ciao
hannes

> -----Ursprüngliche Nachricht-----
> Von: [email-masked] 
> [mailto:[email-masked]] Im Auftrag von DENG, HUI -HCHBJ
> Gesendet: Montag, 21. November 2005 14:05
> An: Xiaoming Fu; [email-masked]; [email-masked]
> Cc: John Loughney; Xiaoming Fu
> Betreff: RE: [Mobopts] Presentation slides for "CXTP using GIST"
> 
> Hi, Xiaoming
>  
> I am still wondering how could you handle IPsec SA transfer, 
> expecially initialize vector and anti-replay window.
>  
> Thanks
>  
> -Hui
>  
> 
> 	-----Original Message----- 
> 	From: Xiaoming Fu [mailto:[email-masked]] 
> 	Sent: 2005-11-20 (星期日) 3:10 
> 	To: [email-masked]; [email-masked] 
> 	Cc: John Loughney; Xiaoming Fu 
> 	Subject: [Mobopts] Presentation slides for "CXTP using GIST"
> 	
> 	
> 
> 	Hi all, 
> 
> 	Due to time limitation, mostly the Q&As in response to 
> some reviewers' 
> 	comments were discussed in the MOBOPTS RG meeting. For 
> anyone interested 
> 	in this draft, the slides are available in the following link: 
> 	
> http://user.informatik.uni-goettingen.de/~fu/temp/cxtpgist/CXT
PusingGIST_IETF64.ppt 
> 
> 	Please drop me/us a message if you think it may be 
> useful, or any 
> 	(additional) comments/suggestions you might have. 
> 
> 	Cheers, 
> 	Xiaoming 
> 
> 	_______________________________________________ 
> 	Mobopts mailing list 
> 	[email-masked] 
> 	https://www1.ietf.org/mailman/listinfo/mobopts 
> 
> +zy'���+jwbƭ!'ڟ&y'~'^ؚݙz-y֧ںh,v!zz+vb隊V+-jGz���޶ʋ^{^ם"'^jǧ
> ؟^ze隊V'jhțuץzע*.&^̬颚g^+az~׫!ޞm觵yr*bz{r鮲)b隊Z+jZr+v+{^-^ֆ)^Zuz}+$yh޷
> +y޲'&+r~ڟ'(z0'!(!}y~b
> 
_______________________________________________
Mobopts mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mobopts

---

From: Xiaoming Fu <[email-masked]>
Date: Mon, 21 Nov 2005 22:39:55 +0100

Hi Hannes, Hui,

Thanks for your insights. My additional comments inline:

Tschofenig, Hannes wrote:
> a) which security mechanisms you use for protection of the context
> transfer between the old ar and the new ar.
> 
In the present draft we are mostly concentrating on the transport
mechanism for transfering contexts related to the end-to-end
communication for a mobile node. Which exact context (ie., object 
format) is still yet to be discussed in a future work.

If you mean the case where last hop communication (between the access
router and mobile node) for a MN-CN flow is using IPsec, some parameters 
such as ESP encryption algorithm and keys would be possible to be 
transferred between access routers. As described in the drafts mentioned 
by Hannes, handling of real time parameters in the SA would be also 
possible.

I guess you are not talking about issue a). For a) actually we could 
utilize the secure mode of GIST (e.g., TLS over TCP/SCTP or IPsec) to 
transfer the desired context, where a secure message association could 
be used in the "half-permanent" fashion, without the need to exchange 
those security parameters on demand either per-MN movement or per-flow.

Cheers,
Xiaoming
> i could not remember xiaoming and john proposing to transfer ipsec
> sas as part of (b). if you would like to transfer ipsec sas then the
> past investigations in, for example,
> <draft-hk-seamoby-ct-ipsec-00.txt> or
> <draft-gopal-seamoby-ipsecctxt-issues-01.txt> might be worth taking a
> look.
> 
> ciao hannes
> 
> 
>> -----Ursprüngliche Nachricht----- Von: [email-masked] 
>> Gesendet: Montag, 21. November 2005 14:05 An: Xiaoming Fu;
>> [email-masked]; [email-masked] Cc: John Loughney; Xiaoming Fu 
>> -----Original Message----- From: Xiaoming Fu
>> [mailto:[email-masked]] Sent: 2005-11-20 (星期日) 3:10 To:
>> [email-masked]; [email-masked] Cc: John Loughney; Xiaoming Fu 
>> Due to time limitation, mostly the Q&As in response to some
>> reviewers' comments were discussed in the MOBOPTS RG meeting. For 
>> anyone interested in this draft, the slides are available in the
>> following link:  
>> Please drop me/us a message if you think it may be useful, or any 
>> Cheers, Xiaoming

---

From: "James Kempf" <[email-masked]>
Date: Tue, 22 Nov 2005 09:03:55 -0800

IPsec context is pretty much out, unless what is exchanged does not involve 
the shared key. So is any AAA context that involves a shared key. Please see 
http://www.ietf.org/internet-drafts/draft-housley-aaa-key-mgmt-01.txt for a 
discussion of why propagating shared keys in this manner is not secure. The 
draft talks specifically about AAA-derived keys, but could as well be 
applied to IPsec derived keys.

            jak

----- Original Message ----- 
From: "Tschofenig, Hannes" <[email-masked]>
To: "DENG, HUI -HCHBJ" <[email-masked]>; "Xiaoming Fu" 
<[email-masked]>; <[email-masked]>; <[email-masked]>
Cc: "Xiaoming Fu" <[email-masked]>
Sent: Monday, November 21, 2005 5:23 AM
Subject: [Mipshop] AW: [Mobopts] Presentation slides for "CXTP using GIST"

> i could not remember xiaoming and john proposing to transfer ipsec sas as 
> part of (b). if you would like to transfer ipsec sas then the past 
> investigations in, for example, <draft-hk-seamoby-ct-ipsec-00.txt> or 

--------------------------------------------------------------------------------

> Mipshop mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/mipshop
>