Re: [MEXT] Review of I-D draft-korhonen-mext-mip6-altsec-06

Hi Jan,

Thanks for the review! We will reflect these along those comments received from Ryuji and Domagoj. Some more detailed comments inline.

On Jan 20, 2011, at 10:34 AM, Jan Zorz @ go6.si wrote:

> Hi,
> 
> It took me quite long to write this review, but finally, here it is :)
> 
> Review comments:
> 
> In general the proposal of using an alternative to IPsec and IKEv2
> seems quite okay. The main purpose of Mobile IPv6 is to enable
> mobility at the IP layer and hence using TLS which is much more widely
> implemented and deployed for use to secure the signaling is good.
> 
> More specific comments:
> 
> - The proposal introduces a new element called HAC. In terms of
>  deployments such a network element may become central for
>  bootstrapping Mobile IPv6. The I-D states that the HAC could be
>  co-located with the HA. In reality, the HAC should be a standalone
>  entity which interacts with AAA and policy engines in a network.

That is purely an implementation issue. We will add some more text around this topic.

> 
> - TLS is widely used for security in the Internet today. Hence the use
>  of TLS does not weaken mobile IPv6 security. TLS is also used only
>  for bootstrapping and not for securing the signaling or traffic.

Right. However, bootstrapping agrees on ciphers that are available for TLS and at the implementation level we then use those ciphers available in TLS library. So in a way we still utilize TLS code base for signaling & traffic ciphering.

> 
> - Describe the steps in figure 1.

ok.

> 
> - The security association scope says that it describes whether the SA
>  is only for signaling or for data as well. Would be useful to make
>  it more explicit.

Ok.

> 
> - Route optimization is an important feature of Mobile IPv6. Hence
>  this alternate security solution should explain how the route
>  optimization signaling messages are secured.

Currently the I-D scopes route optimization out. That is stated at the very end of the document though. We have been thinking to add route optimization support though.

> 
> - Unclear why HTTP headers (Sec 8.2) are being reserved. Could not
>  really understand the purpose.

Just a left over from earlier revisions.

> 
> - Message details are fairly complete and hence should be
>  implementable.
> 
> In summary, the draft is well written and complete and should be
> considered for standardization.
> 
> I'm using DSMIP6-TLS implementations on N900 phone and Ubuntu Linux laptop in everyday life and it seems to work quite well. There are still some implementation issues that needs to be fixed, but overall feeling is very satisfactory.
> 

Thanks.

- Jouni

> Regards, Jan Zorz
> go6.si
> _______________________________________________
> MEXT mailing list
> MEXT@ietf.org
> https://www.ietf.org/mailman/listinfo/mext