Subject: RE: [Mip6] Security Considerations section ofdraft-ietf-mip6-nemo-v4traversal-00.txt

From: "Soliman, Hesham" <[email-masked]>
Date: Tue, 25 Oct 2005 14:14:00 -0400

> Please let me deviate the discussion to the Security Considerations
 > section.  It is very good that the draft has this section contributed
 > from the start since the security aspects are important.
 > 
 > It currently describes a method by which the v6 HA may use 
 > the inherent
 > security established with the v6 Home Address to deduce that 
 > the v4 HoA
 > contained in the BU is securely communicated.
 > 
 > While the method may make sense, maybe some flaws are still possible.
 > 
 > For example, it may be possible that an IPv6 attacker MN 
 > that has good
 > credentials with its HA (verifiable by IPsec with respect to 
 > its v6 HoA)
 > abuses the v4 address of another legitimate MN of same v6 HA.    The
 > attacker may include the legitimate's MN v4 address in its 
 > BU.  Do you
 > think this would not be possible?

=> No that's not possible. The HA knows the IPv4 address corresponding
to the MN's IPv6 HoA. Just like it would know the home prefix corresponding
to the IPv6 HoA of the MR. 

 > Another example is with the NAT traversal scheme.  The current text
 > describes that if two IPv4 addresses in a certain packet don't match
 > then the HA advises the MN to use a certain Refresh Time 
 > (with the NAT
 > detection option).  So I think it is possible for an 
 > attacker MN to fake
 > the IPv4 address of another MN, such that the legitimate MN 
 > receives NAT
 > Detection Options although there's no NAT in place.  Do you 
 > think this
 > would not be possible?

=> Of course, but that attack is known for all NAT detection schemes
including IKE-based schemes. There is no free lunch with NATs. If people
deploy them, they suffer the consequences.

Hesham

 > 
 > Alex
 > 
 > 
 > _______________________________________________
 > Mip6 mailing list
 > [email-masked]
 > https://www1.ietf.org/mailman/listinfo/mip6
 > 

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 25 Oct 2005 20:42:09 +0200

Soliman, Hesham wrote:

>>  section.  It is very good that the draft has this section 
>> contributed from the start since the security aspects are 
>> important.
>> 
>> It currently describes a method by which the v6 HA may use the 
>> inherent security established with the v6 Home Address to deduce 
>> that the v4 HoA contained in the BU is securely communicated.
>> 
>> For example, it may be possible that an IPv6 attacker MN that has 
>> good credentials with its HA (verifiable by IPsec with respect to 
>> its v6 HoA) abuses the v4 address of another legitimate MN of same 
>> v6 HA.    The attacker may include the legitimate's MN v4 address 
>> in its BU.  Do you think this would not be possible?
> 
> => No that's not possible. The HA knows the IPv4 address 
> corresponding to the MN's IPv6 HoA. Just like it would know the home 
> prefix corresponding to the IPv6 HoA of the MR.

How does it know it?  The NEMOv6 spec has a Prefix Table for that, and
the NEMOv4 personal draft too.  This draft does not have such a table.

> Therefore, in order to authorize the mobile node's IPv4 home address 
> binding, the home agent MUST store the IPv4 address corresponding to 
> the IPv6 address that is allocated to a mobile node.

Do you think this text is sufficient?  Don't you think that using IPv4
IPsec makes more sense?

>>  describes that if two IPv4 addresses in a certain packet don't 
>> match then the HA advises the MN to use a certain Refresh Time 
>> (with the NAT detection option).  So I think it is possible for an 
>> attacker MN to fake the IPv4 address of another MN, such that the 
>> legitimate MN receives NAT Detection Options although there's no 
>> NAT in place.  Do you think this would not be possible?
> 
>  including IKE-based schemes. There is no free lunch with NATs. If 
> people deploy them, they suffer the consequences.

That's rhetoric, right?  Too easy to claim weaknesses in some protocol
are due to another protocol.

This makes me think I'm not very sure who are the customers of this
draft and whether they can delegate responsibility to operator's
deployed NATs.

Alex