Re: CGA-based HoA generation for MIP6 (was RE: [Mipshop] Review of draft-arkko-mipshop-cga-cba-04)

Narayanan, Vidya wrote:

> I don't know that this is true. As we know, what we get from IPsec and
> CGAs are quite orthogonal benefits. In the case where the HA assigns the
> HoA via IKEv2, HoA authorization at the HA is not needed, since the HA
> knows that the IPsec SA is tied to the owner of the corresponding HoA.
> Now, systems that allow stateless autoconfiguration of HoAs may or may
> not want to ensure that those IP addresses are authorized and verified.

lets take HoA auto-configuration.

when the MN proposes a home address, the HA checks if
the address has been claimed by/allocated to some
other mobile node. if nobody else is using that home
address, the MN is free to use the address.

if somebody else does want to use the same home
address later on, the HA will reject the request and
allocate a new home address for the MN.

> If a system employs CGAs in the network, it is actually an indication
> that the system deployment cares about IP address ownership
> verification. In this case, it actually seems to me that the HA being
> able to verify the CGA would be very valuable and needed. 

sure. but in this case, CGA-based home addresses do
not add much.

Vijay

_______________________________________________
Mipshop mailing list
Mipshop@ietf.org
https://www1.ietf.org/mailman/listinfo/mipshop