[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Status of IPSEC Key Management
Steve Kent said:
> I believe that the current mobile IP specs talk only about shared
>secrets between the mobile nodes (MNs) and home agents (HAs), but are
>silent on how these values are established and maintained.
This is mostly correct. Mobile IP does not say where the security
association comes from, but we do require that a security association
must exist between a mobile node and its home agent, and that it must
be used for authentication on all Registration Request and Registration
Reply messages. Mobile IP also allows for a security association between
a mobile node and its foreign agent and/or between a foreign agent
and the home agent, but we do not require these to exist. If they do
exist, though, we require that they be used for authentication on
the registration messages, along with the authentication between the
mobile node and its home agent that always must be there.
We assume (and hope) that IPsec key management and key management from
research like that you mentioned at BBN will help provide the necessary
keys and security associations in the future, but for deployment now,
manual configuration of security associations can be used.
Dave
References: