[MEXT] Review of I-D draft-korhonen-mext-mip6-altsec-06

["Jan Zorz @ go6.si" <[e-mail]>]

Hi,

It took me quite long to write this review, but finally, here it is :)

Review comments:

In general the proposal of using an alternative to IPsec and IKEv2
seems quite okay. The main purpose of Mobile IPv6 is to enable
mobility at the IP layer and hence using TLS which is much more widely
implemented and deployed for use to secure the signaling is good.

More specific comments:

- The proposal introduces a new element called HAC. In terms of
   deployments such a network element may become central for
   bootstrapping Mobile IPv6. The I-D states that the HAC could be
   co-located with the HA. In reality, the HAC should be a standalone
   entity which interacts with AAA and policy engines in a network.

- TLS is widely used for security in the Internet today. Hence the use
   of TLS does not weaken mobile IPv6 security. TLS is also used only
   for bootstrapping and not for securing the signaling or traffic.

- Describe the steps in figure 1.

- The security association scope says that it describes whether the SA
   is only for signaling or for data as well. Would be useful to make
   it more explicit.

- Route optimization is an important feature of Mobile IPv6. Hence
   this alternate security solution should explain how the route
   optimization signaling messages are secured.

- Unclear why HTTP headers (Sec 8.2) are being reserved. Could not
   really understand the purpose.

- Message details are fairly complete and hence should be
   implementable.

In summary, the draft is well written and complete and should be
considered for standardization.

I'm using DSMIP6-TLS implementations on N900 phone and Ubuntu Linux 
laptop in everyday life and it seems to work quite well. There are still 
some implementation issues that needs to be fixed, but overall feeling 
is very satisfactory.

Regards, Jan Zorz
go6.si