Subject: RE: Using "a bit" as a protection against bidding down / for some thing else

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Wed, 3 Apr 2002 17:17:22 +0200

> The scenario Brian mentioned
  > > will not be an issue for bidding down attacks
  > > related to mobility. 
  > 
  > Can you explain? I don't see why you can't have an evil MitM 
  > intercepting binding updates and bidding them down.
  > 
  
=> In the case where the iids are somehow cryptographigally
generated, if you change one bit in the address, the result
is that the 2 nodes will end up talking to 2 different
nodes. Or if the attack is only done in one direction
then Bob will talk to Sam instead of Alice. This is 
because by changing the bit in the address, you have 
changed the identity of the device that is establishing
the SA. 
This is the advantage of having the bit inside the 
address. For the mobility cases, the identity is 
the address, so changing the address == changing 
the identity => A talks to C instead of talking 
to B. 

Establishing the SA takes more than one RT, so 
changing it in only one of the messages will
cause the whole process to fail. 

Hesham

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 04 Apr 2002 11:20:32 +0200

It seems to me that the important point is that a host needs
to assert something about the strength of security it requires.
This is a property of a host, not a property of an address.
I become more and more convinced that asserting this property
via an address bit is both unnecessary (it can be done by
a header field that is equally subject to authentication)
and undesirable (overloading).

   Brian

---

From: "Rami Lehtonen" <[email-masked]>
Date: Thu, 4 Apr 2002 12:46:27 +0300

> and undesirable (overloading).

I fully agree. And when AH is used, the source address can also be verified,
which ties the source address and security options for that host.

- Rami

---

From: Jari Arkko <[email-masked]>
Date: Thu, 04 Apr 2002 13:37:29 +0300

Rami Lehtonen wrote:

> And when AH is used, the source address can also be verified,

Obviously when we have strong authentication we don't
have a problem with bidding down! However, one of the
starting points of the MIPv6 security work has been
infrastructureless operation, where strong authentication
with shared secrets or PKIs is not assumed to be available.
Strong cryptographic methods for address ownership can
still work, though.

Jari

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 5 Apr 2002 10:42:19 +0200 (CEST)

> to assert something about the strength of security it requires.

Yes, but other ways to assert security properties between unrelated
nodes in the Internet require a global PKI.
If we had a global PKI today or were rather certain we'll have one in 10 years
I think we can stop this discussion.

> and undesirable (overloading).

I don't understand the authentication comment.

*If* there was a global PKI so that IPsec could be used for these packets
then the information could go in other parts of the packet.
Without it the address (i.e. the "identity" from the perspective
of modifying routing in MIPv6, neighbor discovery, and anycast) seems to be
only place.

What am I missing?

  Erik