Re: [Mip6] draft-dupont-mip6-dhaadharmful-00.txt

[Francis Dupont <[e-mail]>]

 In your previous mail you wrote:

   > => this is more an argument for HA-switch (another way to provide HA
   > assignment)...
   
   Thanks, where is HA-switch discussed, drafted?
   
=> draft-haley-mip6-ha-switch-00.txt and (more general)
draft-devarapalli-mip6-nemo-local-haha-00.txt

I believe one of these I-Ds was proposed for the MIPv6 agenda.

   > The issue with the anycast-like address is the responder must be
   > always the same box in order to use correctly IPsec.
   
   I don't buy into that.  It's like saying that because of IPsec two boxes
   aren't allowed to have same IPv6 address.  It's also ignoring that the
   "unique IP address per box" concept no longer exists since "server farms
   and blades", "IP over VIA" and "modem connected to PDA" got widespread use.
   
=> multiple sources don't work well when two of the security services
are "source origin authentication" and "anti-replay". IPsec is just
not the right protocol here.

   > IMHO the best way to protect current DHAAD is per exchange and not
   > per communication but the real issue is the effort doesn't worth it.
   
   exchange vs. communication?
   
=> exchange := request/reply, communication:= stream of exchanges.
IPsec or SSL/TLS are stream/session oriented, an exchange oriented
security protocol should use per message signature and similar ideas,
not a session key with an anti-replay mechanism.
The problem here is the standard security protocol (IPsec) is not
convenient and to add security from scratch is known to be hard,
so it is better to use something more suitable, DNSSEC is fine because
it has both (in an exchange oriented style BTW) transaction and data
protections...

Regards

[e-mail]

   

_______________________________________________
Mip6 mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/mip6