Subject: Re: [mobile-ip] RR and BU to HA

From: Samita Chakrabarti <[email-masked]>
Date: Thu, 23 May 2002 11:41:19 -0700 (PDT)

> 
>    As long as there is correct SA between MN-homeaddr and HA and
>    home-addr in HOA dst option matches with the authenticated BU
>    MH home-addr part, there is no problem.
> 
> => I disagree: you have the same problem with the COA for the HA.
> 
>    In CN case, separate COA RR check is necessary to avoid reflection
>    attack from another malicous MN.
>    
> => so the COA RR check should be necessary for HA too???
> 

Can you explain the scenarios of threats when the MN is using IPsec with
non-null authentication  to send BU to a home-agent (HA) ?

>    So, the question is how does HA
> 
> => this HA is on the previous visited link.
> 

By HA, I mean home-agent.

You are probably interpreting HA as "home-address" here.

-Samita

>    match the security association in this case ? 
>    I assume that the draft assumes the sequence would be:
>    1. update HA first with your new COA with HoA= MN's home-addr
> 
> => here the HA is the HA on the home link.
> 
>    2. Then send BU to forward packet from previous COA. 
>       In this case HA should do a few extra checks to make sure that the
>       new COA already has a valid BCE.
>       
> => this is not the same HA than in 1.
> 
>       But, I am still not sure how would HA do the SA check for homeaddr
>       in this case ( since homeaddr=previous COA), I believe there is no
>       security association with the previous COA and HA.
>       
> => it should be but the real question is how the SA pair is established...
> Even if this is done before the movement this is not easy.
> 
> Regards
> 
> [email-masked]

---

From: Francis Dupont <[email-masked]>
Date: Thu, 23 May 2002 21:29:20 +0200

=> the only remaining threat is:
 - the MN puts the address of V in the COA
 - the HA trusts the MN which has protected the COA with IPsec
   (so only a malicious MN can perform this attack)
 - the traffic for the MN intercepted by the HA and the traffic for the MN
   genuine to the HA flood the victim V
 (the second kind of traffic is the CN reflexion attack but both:
   - the HA has no way to verify the COA: it must trust the MN
   - packets forwarded by the HA is added to genuine packets)
Hence my conclusion:
 - either we drop Mobile IPv6 until AAA infrastructure is available
 - or we accept the HA trusts its MNs (this can be viewed as the
   authorization to use a service, cf. Mike Thomas' message).

   
   
=> no, if you'd like to register your previous care-of address in a HA
on the previous visited link in order to get "flying" packets to this
previous care-of, then you have two HAs...

Regards