Subject: Re: [mobile-ip] Drafty draft about key establishment for Binding Update

From: Mohan Parthasarathy <[email-masked]>
Date: Tue, 27 Mar 2001 14:05:39 -0800 (PST)

> 
> > => we can do something better: send a part of needed things directly
> > to the care-of address and the remainder to the home address (through
> > the home agent) so the MN will need to get the traffic from both paths
> > (and the MITM will need to intercept the traffic on both paths).
> 
> While such complexity helps for some threats it doesn't deal with
> MITM positioned close to the CN.
> But we can't do much about that threat since the CN doesn't have any 
> prestablished association with the HA or MN.
> 
> The most important threat to handle (that we can handle) is MITM
> attacks on the MNs link.
> 
From RFC 2408, ISAKMP, section 1.7.3,

Man in the middle attacks include interception, insertion, deletion,
and modification of messages, reflecting messages back at the
sender, replaying old messages and redirecting messages.

Do we want all this protection ? I am not sure how long/easy is
to analyse all this once we have a solution ? I think ISAKMP/IKE seems
to be safe from all the above.

-mohan

---

From: Francis Dupont <[email-masked]>
Date: Sat, 31 Mar 2001 12:35:00 +0200

Do we want all this protection ?

=> There are three segments (MN-CN, MN-HA and HA-CN) where the MITM can be.
My idea (split messages on MN-CN and MN-HA-CN) protects against a MITM
which is not on both paths. Drafty draft idea (protect MN-HA tunnel)
makes this a bit stronger: the MITM must be on MN-CN and HA-CN segments
(ie. close to the CN).
Summary:
 - no protection, signaling via MN-CN: MN-CN vulnerable.
 - no protection, signaling via HA: MN-HA-CN vulnerable.
 - drafty draft (signaling via HA): HA-CN vulnerable.
 - split signaling: MN-CN+MN-HA-CN vulnerable.
 - split signaling+drafty draft: MN-CN+HA-CN vulnerable.
If MITM close to the MN must be safe then the drafty draft idea must be used.

   I am not sure how long/easy is to analyse all this once
   we have a solution ?

=> just do it in order to know ?

   I think ISAKMP/IKE seems to be safe from all the above.

=> ISAKMP/IKE uses Diffie-Hellman with strong authentication so it is as
safe as the Diffie-Hellman (ie. large enough groups) and the strong
authentication are. I believe the strong authentication with PKIs is
the most easy to attack (reuse the recent attacks against SSL: provide
a fake DNS (for names/identities) and a fake LDAP (for certificates)
to a peer. In our case the vulnerability is again with an attacker close
to the CN... Previous MIPv6 security is vulnerable to this kind of attacks
on both ends (CN and MN) and a global PKI is by definition more vulnerable
so the new MIPv6 security can be more vulnerable in some points (MITM
close to CN more easy) and less vulnerable in some other points (because
the MN-HA interaction is easier to protect than MN-CN's one for a random CN).
This different trade-off is IMHO a good answer to IESG concerns...

Regards

[email-masked]