Re: [netlmm] Issue: Auth Option support

Hi Vijay,

One comment below,

On Monday 10 September 2007, Vijay Devarapalli wrote:
> Sri,
>
> I agree with "SHOULD" for using IPsec and "MUST" for supporting IPsec
> on the MAG and the LMA.
>
> If thats the consensus, we need to modify a few sentences in the
> draft.
>
> In section 4, replace
>
> >    The signaling messages, Proxy Binding Update and Proxy Binding
> >    Acknowledgement, exchanged between the mobile access gateway and
> > the local mobility anchor MUST be protected using IPsec [RFC-4301]
> > and using the established security association between them.  The
> > security association of the specific mobile node for which the
> > signaling message is initiated is not required for protecting these
> > messages.
>
> with
>
>     The signaling messages, Proxy Binding Update and Proxy Binding
>     Acknowledgement, exchanged between the mobile access gateway and
> the local mobility anchor MUST be protected using security
> associations established between them. The security association of
> the specific mobile node for which the signaling message is initiated
> is not required for protecting these messages.
>
> We need the MUST above since we have to say that the proxy BU and
> proxy BAck must be protected, irrespective of whether IPsec or some
> other mechanism is used.

I understand you want to say that integrity and data origin 
authentication are MUST's. I'm thus suggesting a minor change to your 
text above (rest is fine with me):

      The Proxy Binding Update and Proxy Binding Acknowledgement
      signaling messages exchanged between the MAG and LMA MUST be
      protected using end-to-end security association(s) offering
      integrity and data origin authentication. A security association
      with the mobile node for which the signaling message is issued is
      not required for protection of these messages.

--julien

_______________________________________________
netlmm mailing list
netlmm@ietf.org
https://www1.ietf.org/mailman/listinfo/netlmm