RE: New issue 19: Same addresses for both directions?

Hi Pasi,

Response inline.

Best,
Atul

> -----Original Message-----
> From: Eronen Pasi (Nokia-NRC/Helsinki) 
> Sent: Thursday, February 03, 2005 10:44 AM
> To: Sharma Atul (Nokia-ES/Boston); [email protected]
> Subject: RE: [Mobike] New issue 19: Same addresses for both 
> directions?
> 
> 
> Atul Sharma writes:
> > 
> > I think this is interaction of two issues here. I tried
> > to raise this scenario a couple of days ago to Hannes:
> >
> > * Simultaneous change of addresses
> > * Different IKE address pair in the two directions (Asymmetry)
> > 
> > My thoughts on these are:
> > 
> > * If we have prior knowledge of addresses at the other end,
> >   some kind of simultaneous change of addresses can be 
> >   supported.
> 
> It was already decided a while ago that simultaneous change
> of addresses will be supported (see issues #13 and #17).

I agree. I was referring that this scenario is result of two issues.
Not that issue of simultaneous address change has not been agreed upon.

> > * For asymmetry, clearly initial IKE negotiations can not
> >   support it. (Does it?) In your scenario, at some point in
> >   time A1-B1 (or other symmetric pair) IKE negotiations should 
> >   have succeeded. Question is once IKE has succeeded can MOBIKE,
> >   allow such an asymmetry? For how long (at next renegotiations 
> >   such an asymmetry may not be allowed)?
> 
> Hmm... issue 19 is about asymmetry for IPsec traffic (ESP/AH),
> not IKEv2/MOBIKE messages (I don't think anyone is proposing 
> breaking the rule that IKE responses are sent to the same 
> address the request came from).
> 
> If the MOBIKE protocol ends up sending all addresses of both
> parties in the initial IKE negotiations (IKE_SA_INIT/IKE_AUTH),
> and each peer selects the addresses for outbound IPsec SAs
> independently, then conceivably asymmetry could happen 
> even at that point.

That would mean in SAD the incoming and outgoing SAs of the same
SA pair can have different tunnel endpoints. Now that in the 
incoming direction a variation of src,dst addresses can be used
for searching an SA, we may have to match the src,dst of the
IPsec traffic in both direction. I do not know if such an asymmetry
is allowed on IPsec traffic (we agree it is not allowed on IKE/MOBIKE
traffic).

> >   Also, the issue is of more general nature than just 
> >   restricted to MOBIKE. I have been meaning to raise this 
> >   issue of asymmetry for sometime to get a new BoF. But am 
> >   not familiar with the BoF procedure.
> > 
> >   What do folks on this list think: a new BoF could be 
> >   requested to handle IKE asymmetry? Clearly issue has 
> >   more broader implications.
> 
> The BoF procedure is explained in RFC 2418. But I don't 
> quite see why a BoF would be better place than MOBIKE WG
> to discuss this?

Because it has implications for other scenarios as well, for example
a Mobile IP End-to-End Asymmetric Security.

> Best regards,
> Pasi
>