Re: CGA-based HoA generation for MIP6 (was RE: [Mipshop] Review of draft-arkko-mipshop-cga-cba-04)

At 05:37 AM 8/15/2006, Jari Arkko wrote:
>Christian Vogt wrote:
>
> >From a security perspective, I don't currently see a requirement for the
> >HA to know that the HoA is CGA-based, given that all MN-HA security is
> >IPsec-based:
> >
>Agreed.

I am confused by this and trying to understand the 
statement.  Doesn't this really depend on the security 
requirements?  CGAs and secure channels (IPsec SA) provide very 
different things.  We might say that there are no current 
requirements for HoA authorization and I can buy that, but saying 
that the presence of an IPsec-based secure channel obviates the need 
for CGAs confuses me.  What am I missing?

regards,
Lakshminath

> >From a practical standpoint, there may be a benefit for the HA to know
> >that the MN's HoA is CGA-based.
> >
> >
>Its possible to design mechanisms that employ the same
>tools also for the home agent registrations, or use the
>help of the home agent in the RO process. Such mechanisms
>would likely have some advantages. OTOH, there is also
>some value in keeping the two RO and HA registration
>mechanisms separate. E.g., you don't have to sync HA and
>MN code updates. IKEv2, auth option, and RFC 3776 all
>can support CGAs, though some with extra config effort.
>
>--Jari
>
>
>_______________________________________________
>Mipshop mailing list
>Mipshop@ietf.org
>https://www1.ietf.org/mailman/listinfo/mipshop

_______________________________________________
Mipshop mailing list
Mipshop@ietf.org
https://www1.ietf.org/mailman/listinfo/mipshop