Re: Mobile IP and Mobike

Tero Kivinen wrote:

> Vijay Devarapalli writes:
> 
>>IPsec SA is tied to the Home Address. IKE SA is tied to the CoA.
>>so a Binding Update can be sent right away.
> 
> 
> That is not following the IKEv1/IKEv2 RFCs nor the architecture draft.
> There tunnel mode SAs are tied to the IP addresses which are used to
> when it is negotiated in the IKE. It is not very clean solution that
> Mobile IP goes and modifies the internal databases of the IPsec module
> (SAD). If you want to use standard IPsec then you need to renegotiate
> the IPsec and IKE SAs before sending the binding update. 


you gotta be kidding me. :) the selectors are applied to
the inner IP header, not the outer one. and the selectors are
what are negotiated.

we got the Mobile IPv6 + IPsec documents reviewed by numerous
folks from the security area.

we have interoperable implementations (infact many
implementations). so, have to strongly disagree with you.

anyway, this will be the last email on this thread from me.

Vijay