Re: IPsec and Mobile IPv6

[Jari Arkko <jari.arkko@xxxxxxxxx>]

Hi Francis,

> The second version of my draft about IPsec and Mobile IPv6 is
> available (name : draft-dupont-ipsec-mipv6-01.txt).


(Sorry for the crosspost -- perhaps replies can go to the mobile ip
list only.)

Your draft looks like a very useful analysis of various cases
regarding mobility and IPsec. But I still lack some practical
background information so that this work could be taken in account
in the relevant protocol descriptions. In particular, could you
classify your recommendations as

  1) Those that restate something which already is in the
     current protocol specifications (but perhaps not stated
     clearly enough).

  2) Those which fix something that would break MIPv6
     security. Draft draft-ietf-mobileip-ipv6-18.txt uses IPsec
     for a part of its security, namely for the HA - MN signaling.
     A more detailed description including SPD entries can be
     found from http://www.piuha.net/~jarkko/publications/mipv6/ipsec_usage.txt

  3) Those which fix something that would break IPsec
     when used for protecting regular payload traffic
     in the presense of MIPv6.

  4) Those that make IPsec work smoother, more efficiently, or
     with less configuration when used together with mobility
     or for the protection of mobility signaling.

  5) Architectural long-term recommendations.

  6) Something completely different.

In particular class 2 is interesting for completing the MIPv6 work,
as is class 3. From my initial understanding, your recommendations
can be classified as follows:

   1) A, C1, C2, E1, E2, E3, G, H, I, K, M, O, Q
   2) P [makes use of IKE for HA-MN security hard -- this is
      very interesting, thanks!]
   3) nothing?
   4) B, F [and I think we were disagreeing on the mip list whether
      these two are good goals], L1, L2, R
   5) nothing?
   6) D [of course!], J
   unclear: N

Is this correct? How do we go about fixing P, is your recommendation
the only way to handle that? Is there anything in the MIPv6 documents
that you'd like to clarify in class 1?

Jari