Re: [Mip6] Before BU..

 In your previous mail you wrote:

       Before MIPv6 process Binding update, I saw that there are RR, IPsec 
   , IKE.

=> do you speak about the MN-HA case, the MN-CN case or both?
Currently:
 - IPsec is mandatory and IKE recommended in the MN-HA case
 - RR is mandatory in the MN-CN case but there are some proposals
   for stronger but dedicated schemes in this case:
   * preconfigured Kbm (draft-ietf-mip6-precfgKbm-00.txt)
   * IPsec (draft-dupont-mipv6-cn-ipsec-01.txt)
   * CGA (draft-haddad-mip6-cga-omipv6-02.txt)
   ...

   I heard that IPsec make RR securely (protect man-in-the middle all paths).

=> yes, RR security relies on IPsec between MN-HA.

   And before we use IPsec, we need to setup SA via IKE.  

=> currently one has the choice between manual keying, automatic keying
using IKE and automatic keying using something else than IKE.
Obviously the last solution is dedicated, i.e., it relies on a
preagreement but this constraint is not a real problem as there should
be some kind of preagreements in any case.

       So, if we used IKE (may be SKIP (diffie-cert) ) to generate Kbu (Kbm)
   and take out IPsec and RR. I think, it may decrease packet delay time 
   significantly, isn't it?

=> if I understand well you propose to create a DOI for IKE in order
to build directly a Kbm? I can't see major advantages vs preconf Kbm
or IPsec...

Thanks

Francis.Dupont@enst-bretagne.fr

_______________________________________________
Mip6 mailing list
Mip6@ietf.org
https://www1.ietf.org/mailman/listinfo/mip6