Re: does mobike support end-to-end use of tunnel mode?

Mohan Parthasarathy wrote:
> > But there's practically no way the mail server's PAD would contain
> > child SA authorization data saying that "pasi-dot-..  is allowed
> > to create IPsec SAs with traffic selectors matching address
> > 192.0.2.123", since the address came from DHCP...
> 
> Hmm..won't you be using a transport mode SA for this and MOBIKE 
> is clearly out of scope here ?

You can use tunnel mode between two hosts if you want. 

> > None of this is really specific to MOBIKE as such, so I think 
> > we should not add text about this to the MOBIKE draft...
> 
> Agreed. Now, we can even put the reference and say that
> host-to-host case is out of scope.

Well... if you have host-to-host tunnel mode IPsec working in a 
secure manner, MOBIKE could work as well. But this situation 
is pretty rare.

Best regards,
Pasi