Subject: [mobile-ip] A proposed MIPv6 security policy statement

From: Pekka Nikander <[email-masked]>
Date: Sun, 06 Jan 2002 15:46:25 +0200

Hi all,

Based on my observation about the "future attack" against
RR (see my previous message), may I suggest that we establish
a recommended security policy statement for all IPv6 nodes
that implement MIPv6 CN functionality.

I'd like the present the following statement as a seed for
discussion:

    A node MUST NOT establish a binding unless the BU has
    been properly protected.  If the BU is protected only
    with return reachability (RR), the maximun lifetime
    of the binding SHOULD NOT exceed MAX_RR_BU_LIFETIME minutes.
    If the BU is protected with cryptographically generated
    addresses (CGA) or by stronger local means, e.g. by
    employing AAA or a local PKI, the maximum lifetime of
    the binding is a matter of local policy.

    If a binding has been created in a result of a BU
    protected only with RR tests, and the MN wants to
    renew or change the binding, the CN MUST check the
    return reachability of both the care-of-address and
    the home address.  If, on the other hand, the binding
    has been created in a result of a BU protected with
    CGA or stronger means, the test checking the return
    routability of the _home_address_ MAY be skipped.
    The return routablity of the care-of-address MUST be
    performed in any case.

    Rationale:

    RR is computationally much cheaper than CGA, but it
    leaves open some threats that are not present in IPv4.
    However, there seems to be environments where the
    protection provided by RR is enough.  On the other hand, to
    provide reasonable protection against the aforementioned
    threats, RR of _both_ the home address and care-of-address
    MUST be checked every time an RR based binding is renewed
    or changed.

    CGA, combined with initial RR, on the other hand, provides
    reasonable grounds to believe that the CN really "owns"
    the home address.  Consequently, if CGA is used, it seems
    to be sufficient to check the RR of the CoA whenever
    a binding is renewed or changed.  Note that checking the RR
    of the CoA may be easily mixed with the regular packet stream
    (and therefore e.g. does not cause problems to packet
    header compression) while checking the RR of the Home
    Address requires an extra exchange that falls outside
    the normal packet flow.

I think that statement might serve us in desiging the
MIPv6 security solution in such a way that it allows
flexibility of mechanisms without opening too many
vulnerabilities.

A reasonable value for MAX_RR_BU_LIFETIME might be e.g. a
few minutes.

--Pekka Nikander