Re: comments on draft-ike-mobike-design-03.txt

On Mon, 29 Aug 2005 15:08:02 +0200
Francis Dupont <[email protected]> wrote:

>  In your previous mail you wrote:
> 
>    I read draft-ike-mobike-design-03.txt and had a few comments/questions
>    as below:
>    
>    Technical Comments:
>    
>    - Section 4, fourth paragraph, it says "Using this API, the MOBIKE
>      daemon can create entries in the Security Association (SAD) and
>      Security Policy Databases (SPD)." I believe "this API" refers to
>      PF_KEY which is initially designed as an interface to SAD. So, the
>      draft should be accurate in this respect, IMHO.
> 
> => PF_KEY can't offically be used to manage the SPD so IMHO the
> current wording should be kept.

That's the point that I wanted to make. The current texts could be read
in a way that both SADB and SPD can be accessed by the API (PF_KEY).

   Figure 3 shows an example protocol interaction between a pair of
   MOBIKE peers.  MOBIKE interacts with the IPsec engine using the
   PF_KEY API [RFC2367].  Using this API, the MOBIKE daemon can create
   entries in the Security Association (SAD) and Security Policy
   Databases (SPD).

So just thought that it would be bettter to say:

   Figure 3 shows an example protocol interaction between a pair of
   MOBIKE peers.  MOBIKE interacts with the IPsec engine using certain
   API.  PF_KEY [RFC2367] can be used by the MOBIKE daemon to access
   the Security Association Database (SAD).


Regards,
Shinta

> 
>    - Section 5.8 (Scope of SA changes), I think this is very important
>      issue. Separate management of IKE SA and IPsec SA in terms of address
>      update allows us more flexible and (potentially) user-friendly
>      operation although there will be more complexity and overhead to
>      do so.
>    
> => I agree on both: it is an important issue and the current decision is bad.
> 
> Regards
> 
> [email protected]