Subject: Re: [MEXT] MEXT Digest, Vol 22, Issue 23 draftebalard-mext-hld-security-00.txt

From: [email-masked] (Arnaud Ebalard)
Date: Fri, 01 May 2009 10:26:58 +0200

Hi Victor,

"Victor Blake" <[email-masked]> writes:

> Your assumption in 4.1 is that the HA relies exclusively on the BU message
> from the MN.

AFAICT, this is what RFC 3775 specifies. Hence my concerns.

> In fact an HA can rely not only on the BU message itself, but also the
> source of the update (BU). That is that the HA, may (not necessarily
> but could) know about the Layer 2 source address of MN to validate the
> update is coming from the MN it says it is coming from based on 
> the L3 address. In short, the L2 and L3 address can be correlated.

I am not sure introducing the L2 address in the solution space will
help but I may be wrong. Anyway, this will not solve the issue because
the MN may still act (drop protection) upon reception of a fake RA. Such
a proposal may help preventing the emission of the BA but this is just a
workaround. 

> I believe that there could be other stateful methods as well uses
> other link attachment mechanisms such as MIH, DNA, or FMIP in which
> the sequence in the state machine would not be valid if such an attack
> occurred within the appropriate preceeding and post registration
> events.

It's possible. But this would be worth looking if the same kind of
attacks apply or not. I would bet that the Security Considerations
sections of associated documents do not consider such attacks.

> If we try to address the argument beyond just that particular message
> to other DoS, I think it is true that there could be cause for
> concern. However, regardless of IPsec, Layer 2 DoS attacks would in
> any event still be possible. Right ?

I agree with you that DoS attacks against a MN are possible (easy) but
there are (at least in my opinion) a limited concern compared to attacks
that may lead an IPsec-protected MN to drop its protection in front of
an attacker.

RFC 3775 does not prevent a particular implementation to test the
link/path it is switching to in order to verify that it indeed provides
some real connectivity to the outside world (i.e. to the Home
Agent). At the moment, a RFC3775-compliant MN has no way to be sure that
the router advertising its Home Prefix is indeed its HA, i.e. that it is
at home. 

Thanks for your comments, Victor.

Cheers,

a+

---

From: "Victor Blake" <[email-masked]>
Date: Fri, 1 May 2009 09:41:27 -0400

Arnaud,

To be clear, I wasn't suggesting that a Layer 2 to 3 address match be
required, just that (as you say towards the end of your reply) it is
permissible and found in some products. 

Thanks for your response.
-Victor

-----Original Message-----
From: Arnaud Ebalard [mailto:[email-masked]] 
Sent: Friday, May 01, 2009 4:27 AM
To: Victor Blake
Cc: [email-masked]
Subject: Re: [MEXT] MEXT Digest, Vol 22, Issue 23
draftebalard-mext-hld-security-00.txt

Hi Victor,

Cheers,

a+