Subject: Re: [mobile-ip] Piggybacking - DT recommendation

From: "Michael Roe" <[email-masked]>
Date: Thu, 14 Feb 2002 22:26:31 -0000

I think that these were the wrong questions to be asking:

1. The size of a binding update depends on which authorization method
   is being used. In some of the CGA schemes, binding updates are
hundreds
   of bytes long, because they contain public keys and so on.

   The decision to allow or disallow piggybacking is partly dependent
   on how big the piggybacked object is going to be, so it's hard to
   answer this question independently of the authorization scheme.

2. IPSec
 > We recommend that when IPsec protection is used, it is
 >  always used in *addition* to RR (or CGA) methods, not as
 >   a replacement. Thus RR (or CGA) methods would be used to
 >   protect MN - CN Route optimization procedures even when IPsec
 >  is used.

 There seem to be two separate authorization checks that are needed 
 before accepting a binding update:
 (a) Check that the sender is authorized to use the HoA
 (b) Check that the sender is authorized to the the CoA

 As far as I can see, an IPsec SA established using, for example,
 X.509 certificates with IP addresses (not DNS names) in them is 
 perfectly adequate for checking HoA authorization.
 It's not so good for checking CoA authorization, because at the time
the
 certificate is issued you don't know what CoA the node is going to be
using.

 My current view is that:
 - you have to do RR for the CoA in all cases;
 - if you have an IPSec SA, you don't need RR for the HoA;
 - if the HoA is cryptographically generated, you still need to check
that
   it's RR

Mike

---

From: "James Kempf" <[email-masked]>
Date: Thu, 14 Feb 2002 19:00:11 -0800

Mike,

Some questions.

>  - you have to do RR for the CoA in all cases;

Even if the CoA is cryptographically generated? 

>  - if you have an IPSec SA, you don't need RR for the HoA;

OK.

>  - if the HoA is cryptographically generated, you still need to check

Always? That is, can you do it once then not? Otherwise, I don't
see much point in using cryptographically generated addresses.

            jak

---

From: "Jari Arkko" <[email-masked]>
Date: Fri, 15 Feb 2002 10:23:46 +0200

>    answer this question independently of the authorization scheme.

True.

>  - if the HoA is cryptographically generated, you still need to check

I agree with the first and third items. As to the second I think I
*technically* agree in the sense that your assumpion (ip addresses
in certs) is taken in account. However, I may disagree on the likelihood
of the assumption really being true.

We could of course state that HoA RR MAY be omitted if the cert
has an IP address but MUST be performed otherwise. I'm just
somewhat concerned that we'd be specifying a special case
handling for something that wouldn't be a very likely case in
real life, and introducing some additional complexity to products.

Jari

---

From: "Jari Arkko" <[email-masked]>
Date: Fri, 15 Feb 2002 10:41:59 +0200

> Even if the CoA is cryptographically generated? 

Hmm.... I believe so. CGA would prevent bombing of
a specific host, but if there was no CoA RR test you'd
still be able to flood a network.

> see much point in using cryptographically generated addresses.

I believe once is enough here, at the beginning. It's the same
flooding argument, but the situation with the HoA and the CoA
is different in the sense that HoA stays in the network that we
have then verified with RR (and host with CGA), while CoA 
moves from network to another.

Jari

---

From: Claude Castelluccia <[email-masked]>
Date: Fri, 15 Feb 2002 09:56:19 +0100

Jari Arkko wrote

> moves from network to another.

I am not sure whether once is enough. I would say that with CGA you still
need to perform HoA RR periodically but not each time you move (so you do
have
the handover performance problem of "regular" RR).

The explanation is the following. In general, HoA RR is useful to
1- make sure that the BU was sent by the legitimate MN
2- avoid the "future" attack (as desribed by Pekka N.)

CGA solves the 1st problem but you still need to run a HoA RR periodically
to solve the 2nd one...

Claude.

--

----------------------------------------
Claude CASTELLUCCIA, INRIA Rhone-Alpes
ph:  +33 4.76.61.52.15 (fax: 52.52)
http://www.inrialpes.fr/planete/

---

From: "Jari Arkko" <[email-masked]>
Date: Fri, 15 Feb 2002 11:40:40 +0200

Claude, I think we are in rough agreement though my explanation is
a bit different. I did mean to say "periodically but not very often" instead
of "once". I believe Residual_threats.txt talked about hours or days for
CGA.

The rationale for this is the differences in kinds of future attacks that
you can launch with RR or CGA. With RR, you can launch a specific
attack against a specific host, while with CGA at most you achieve
some flooding in the network that you visited <= a day ago.
  I am not sure whether once is enough. I would say that with CGA you still 
  need to perform HoA RR periodically but not each time you move (so you do have 
  the handover performance problem of "regular" RR). 
  The explanation is the following. In general, HoA RR is useful to 
  1- make sure that the BU was sent by the legitimate MN 
  2- avoid the "future" attack (as desribed by Pekka N.) 

  CGA solves the 1st problem but you still need to run a HoA RR periodically to solve the 2nd one...

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 18 Feb 2002 16:28:56 +0100 (CET)

Mike,

The above assumes that there are CAs for PKIs that will
actually put IP addresses as subject(Alt)name, and that folks will
actually trust those CAs to have correct IP addresses in the certs.

It also assumes that the IETF community thinks it is a bad idea
to keep IP addresses in certificates. RFC 2956, which is a report from
an IAB workshop, in section 3.4 seems
to indicate that this might not be considered a good idea but instead something
that should be avoided.

>  - if you have an IPSec SA, you don't need RR for the HoA;
Given your text above I think you omitted a few conditionals here like
- the subject(atl)name in the certificate used to create the IPsec SA
  is the HoA, and
- the IKE implementation verified that this IP address was used during
  the key exchange
	
>  - if the HoA is cryptographically generated, you still need to check

Yep.

  Erik