Re: [netlmm] Issue: Auth Option support

Julien Laganier wrote:
> Hi Vijay,
> 
> One comment below,
> 
> On Monday 10 September 2007, Vijay Devarapalli wrote:
>> Sri,
>>
>> I agree with "SHOULD" for using IPsec and "MUST" for supporting IPsec
>> on the MAG and the LMA.
>>
>> If thats the consensus, we need to modify a few sentences in the
>> draft.
>>
>> In section 4, replace
>>
>>>    The signaling messages, Proxy Binding Update and Proxy Binding
>>>    Acknowledgement, exchanged between the mobile access gateway and
>>> the local mobility anchor MUST be protected using IPsec [RFC-4301]
>>> and using the established security association between them.  The
>>> security association of the specific mobile node for which the
>>> signaling message is initiated is not required for protecting these
>>> messages.
>> with
>>
>>     The signaling messages, Proxy Binding Update and Proxy Binding
>>     Acknowledgement, exchanged between the mobile access gateway and
>> the local mobility anchor MUST be protected using security
>> associations established between them. The security association of
>> the specific mobile node for which the signaling message is initiated
>> is not required for protecting these messages.
>>
>> We need the MUST above since we have to say that the proxy BU and
>> proxy BAck must be protected, irrespective of whether IPsec or some
>> other mechanism is used.
> 
> I understand you want to say that integrity and data origin 
> authentication are MUST's. I'm thus suggesting a minor change to your 
> text above (rest is fine with me):
> 
>       The Proxy Binding Update and Proxy Binding Acknowledgement
>       signaling messages exchanged between the MAG and LMA MUST be
>       protected using end-to-end security association(s) offering
>       integrity and data origin authentication. A security association
>       with the mobile node for which the signaling message is issued is
>       not required for protection of these messages.

Sounds good to me.

Vijay

_______________________________________________
netlmm mailing list
netlmm@ietf.org
https://www1.ietf.org/mailman/listinfo/netlmm