Re: [mif] draft-mglt-mif-security-requirements-01

Daniel,

In principle, the same could be accomplished via separate SA on each path, even if the paths pertain to the same SCTP or MPTCP connection. Correct? This obviously adds cost to SA establishment.

Georg

________________________________
From: Daniel Migault [mailto:mglt.ietf@gmail.com]
Sent: Thursday, April 05, 2012 10:29 AM
To: Hampel, K Georg (K Georg)
Cc: mif@ietf.org
Subject: Re: [mif] draft-mglt-mif-security-requirements-01

That's correct. It provides IPsec the Multiple Interfaces features of SCTP or MPTCP.  The goal is that MIF Nodes can deal with IPsec protected communications.

BR
Daniel
On Thu, Apr 5, 2012 at 4:04 PM, Hampel, K Georg (K Georg) <georg.hampel@alcatel-lucent.com<mailto:georg.hampel@alcatel-lucent.com>> wrote:
Daniel, all,

I read draft-mglt-mif-security-requirements-01.

Just to make sure I got the essence: The draft proposes to extend IPsec/MobIKE so that a multihomed host can simultaneously sustain multiple paths to the same security gateway or app server using the *same* SA. MobIKE would have to be upgraded to dynamically add/delete such paths.

Purpose: Such an extension would avoid the need to establish separate SAs for each path.

Is that correct?

Regards,
Georg

_______________________________________________
mif mailing list
mif@ietf.org<mailto:mif@ietf.org>
https://www.ietf.org/mailman/listinfo/mif

--
Daniel Migault
Orange Labs -- Security
+33 6 70 72 69 58