Subject: Re: [MULTIMOBSEC-API] first steps in APIs

From: Jari Arkko <[email-masked]>
Date: Mon, 08 May 2006 14:32:37 +0300

Michael,

>     >> What does shim6 have in common with IPsec over IPv4?  This
>     >> question is not an argument, but rather, a genuine question.
>
>     Shinta> As you pointed out, currently SHIM6 only handles IPv6
>     Shinta> addresses in its locator management.  But in the future, it
>     Shinta> could also support IPv4 locator as well.  It is addressed in
>
> ...
>
>     Shinta> So, there is not need to exclude IPv4 locator management
>     Shinta> from the common part, I think.
>
> I still see an empty set with IPsec over IPv4, as we don't deal with
> locators at all.

What do you mean by "IPsec over IPv4", exactly? I see that
everything in the below list needs to do locator management
and failure detection:

- Shim6 (currently v6 only but likely to be extended)
- Hip (currently leaves this part to handwaving, but should be specified)
- Mobile IP/monami6 (same situation as in hip)
- Mobike (has its own locator and reachability management)

All of these also need to have some interaction with upper
layers, at least to provide a change indication.

Out of the four cases, if you guys want to work on locator
management and reachability detection PROTOCOLS, this
would likely be easy for Shim6 and Hip by extending the
current Shim6 scheme. Its very easy to make them the
same, given that the same protocol numbers etc. are
used. However, there's a potentially large work ahead to
figure out how all the v4 and NAT details actually happen.
This was hard in MOBIKE WG, and the problem was
somewhat restricted. Whether you want to include
mobile IP (or mobike) in this protocol development is
an open question.

On the other hand, if you want to develop some APIS in
this space, then we have another situation. Probably could
have similar APIs from all of the four.

--Jari

_______________________________________________
MULTIMOBSEC-API mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/multimobsec-api

---

From: Michael Richardson <[email-masked]>
Date: Mon, 08 May 2006 15:27:59 -0400

>>>>> "Jari" == Jari Arkko <[email-masked]> writes:

    >> I still see an empty set with IPsec over IPv4, as we don't deal with

    Jari> What do you mean by "IPsec over IPv4", exactly? I see that
    Jari> everything in the below list needs to do locator management
    Jari> and failure detection:

    Jari> - Shim6 (currently v6 only but likely to be extended)
    Jari> - Hip (currently leaves this part to handwaving, but should be specified)
    Jari> - Mobile IP/monami6 (same situation as in hip)
    Jari> - Mobike (has its own locator and reachability management)

    Jari> All of these also need to have some interaction with upper
    Jari> layers, at least to provide a change indication.

  Yes, but a user of IPsec with IPv4 (such as BTNS + channel binding +
NFSv4) needs none of this.
  
  MOBIKE is specifically chartered such that the user of the IPsec never
sees the motion. Sure, the IKE needs to know about locators, and get
hints, but that has nothing to do with the IPsec SAs themselves.

- -- 
]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] [email-masked]      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

    "The Microsoft _Get the Facts CD_ does not work on Linux." - orospakr