available automated key distribution mechanisms were the main reason why markets decided to not widely implement IPsec - except for VPN uses. The IKEv2 [90] is the main protocol for key management. IKEv2 can also be used to set up SAs between nodes. 3.8.4 Cryptographic Algorithms To enable interoperability between different nodes, a set of mandatory cryptographic algorithms has been listed in RFC 4835 [126]. The mandatory encryption algorithms are: NULL, AES-CBC with 128-bit keys, and TripleDES-CBC. The mandatory authentication algorithm is HMAC-SHA1-96. In this book we will not look at the details of these algorithms. 3.8.5 MOBIKE As described in Section 3.7, nodes can move and in the case of movement, IPv6 addresses change. The host-based mobility solutions utilize tunneling to enable use of static HoA. The IPsec in tunnel mode is architecturally very close to host-based mobile IP, and therefore 'IKEv2 Mobility and Multihoming (MOBIKE)' [127] extensions have been Introduction to IPv6 defined to allow changing of the outermost, 'CoA', IPv6 address used to encapsulate the tunneled IPv6 traffic. As MOBIKE allows the updating of SAs after movement, or if new IP addresses become available on additional network interfaces, both break-before-make and make-before-break are supported. MOBIKE is an attractive technology to provide mobility in the VPN scenarios, as it does not require new network entities and as the security gateway already provides an anchor point in the network. Furthermore, while the host changes are a problem for host- based mobile IP, the changes are not as big as a problem for MOBIKE as the host has to be already modified to support IPsec tunneling. Application Programming Interfaces The introduction of IPv6 brings changes also to Application Programming Interfaces (API), including users of APIs and to the implementations of APIs. Depending on the style of the interface the changes vary from minor to significant. The APIs that provide IP address family agnostic usage approaches do not necessarily ne