Subject: RE: Allocating a bit in the RFC2374 Interface Identifier

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 21 Mar 2002 09:42:42 -0800

> 
> 
> Pekka Savola wrote:
> > We MUST NOT reserve bits in the address to support IPR'd mechanisms.
> 
> Actually, the intention is just the reverse.  The intention 
> is to reserve a bit (or bit pattern) so that the IPR'd 
> mechanims NEED NOT to be used for future better security 
> protocols.  CGA can be used independent on whether there are 
> any bits reserved or not.
> 
> The bit method would leave the door open to any future 
> security mechanisms, including those based on AAA and CGA.
> 
It is not very clear as to why you have to reserve a bit in the
address to express different security mechanisms being used. Why can't
this be built into the protocol itself ? Is it because that the future
security mechanisms will not use the same set of message exchanges as
RR and hence you want a protocol independent way of indicating the
method ?
I would assume that any mechanism to establish the binding between home
address and care of address  would have a few message exchanges. Can you
not
"indicate" which mechanism is being used in the first message being sent
as part of establishing the binding ? I am not sure whether I am missing
the obvious here. In your note that you sent :

"Now, when bob receives the packet sent by Alice, he has no other
knowledge
about Alice except the packet itself. In particular, the only
information
he has about Alice is the source IP address in the packet".

I am missing something here. Isn't the packet carrying any other
information at all ?

-thanks
mohan

> But I think Erik is better in expressing the issue, he first 
> proposed the bit method anyway.
> 
> --Pekka Nikander
> 
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
>

---

From: Pekka Nikander <[email-masked]>
Date: Thu, 21 Mar 2002 14:28:32 -0600

Mohan Parthasarathy wrote:
> "Now, when bob receives the packet sent by Alice, he has no other knowledge
> about Alice except the packet itself. In particular, the only information

An attacker can change any field in the packet.  However, if the
attacker changes the source address, the packet is not about Alice
any more.  Thus, the packet does carry information, but the only
piece of information that can be _securely_ relied on is the address.

I think others, like Dave Thaler, are saying this more clearly here,
probably due to my shortcomings in handling the English language.

--Pekka

---

From: Jari Arkko <[email-masked]>
Date: Thu, 21 Mar 2002 22:41:16 +0200

Mohan Parthasarathy wrote:

> t very clear as to why you have to reserve a bit in the
> RR and hence you want a protocol independent way of indicating the method ?

Because the MitM attacker can change everything related to these
messages, it doesn't help to put anything to the messages for the
bidding down protection.

Note that the MitM can also change the IP address, but if he does
so, he is *not* attacking the original host, as the address is
changed.

Jari

---

From: Keith Moore <[email-masked]>
Date: Thu, 21 Mar 2002 17:18:48 -0500

> so, he is *not* attacking the original host, as the address is

unless of course the MitM can convince that host to take on that address
as an alias.

---

From: Keith Moore <[email-masked]>
Date: Thu, 21 Mar 2002 17:18:48 -0500

---

From: Keith Moore <[email-masked]>
Date: Thu, 21 Mar 2002 22:26:06 -0500

> So Mallory says that his address M is an alias for Alice's address A. Ok.
> What if Bob looking at A could know (yes, signalled by a bit) that A
> it is only aliasable by very secure mechanisms. 

Bob doesn't necessarily see A.  Even if Bob sees A, that doesn't mean
that A is reachable from Bob.
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: gabriel montenegro <[email-masked]>
Date: Fri, 22 Mar 2002 04:39:32 +0100

Keith Moore wrote:

> Bob doesn't necessarily see A.

I'm confused. What problem are you looking at? The problem at hand is that
of addresses for which redirection information is fed to the end hosts. This may
apply to mobile ip addresses or to anycast addrs (for some implementations of anycast as
talked about, for example, by Fred Baker). This redirection is basically equivalent to
inserting host route entries for a given address A at end hosts (Bob).

So the trick is to convince Bob to insert into its route table a host route entry for
A at some_address. If Bob doesn't know A, I think we're talking about a very
different problem. What are you asking Bob to insert into its routing table?

-gabriel

---

From: gabriel montenegro <[email-masked]>
Date: Fri, 22 Mar 2002 04:22:43 +0100

So Mallory says that his address M is an alias for Alice's address A. Ok.
What if Bob looking at A could know (yes, signalled by a bit) that A
it is only aliasable by very secure mechanisms. That's the whole point.
Mallory would then be forced to break any of several very strong
(using crypto and explicit trust relationships) mechanisms:

    - AAA
    - PKI
    - CGA
    - etc

RR would definitely not be included here.

-gabriel