Subject: [mobile-ip] Unresolved issue #4: BM authentication

From: Jari Arkko <[email-masked]>
Date: Fri, 03 May 2002 22:27:05 +0300

the mobile node that the correspondent node does not have a
binding. This message is sent when the mobile node sends route
optimized traffic directly to the correspondent node and the
correspondent node has e.g. rebooted recently.

It is also the intention to use the Binding Missing message (we may
have to rename it) to indicate that an unrecognized MH Type field was
seen in a message.

In the current specification, Binding Missing is not authenticated.
Therefore, it can be sent by anyone in the Internet, in particular if
the sender is not restricted by ingress filtering. The only
requirement is that the attacker must know the care-of address the
mobile node is currently at. Of course, if the mobile node
implementation has some information from e.g. TCP layer that packets
are getting through, it may choose to ignore bogus BM messages. But
such information is not always available.

Question: Does the BM message need authentication? Can we authenticate
it? How? Given that the BM message is sent e.g. after a reboot of the
correspondent node, it is impossible to use any previous RR-generated
keying material to authenticate the BM. The other alternatives for
authentication are as follows:

1) No authentication needed.

2) After receiving the BM, the mobile node would not believe this
    message until it has sent a new request to the correspondent node
    and gotten the same answer about the existence of the binding (or
    MH Type). This new request would be sent with a cookie, and the
    reply would have the same cookie.

3) Charlie's method: in the BM, return a hash of the offending
    packet.

4) A variant of 3 where the correspondent node MUST produce the
    hash, but the mobile node MAY (not MUST) use this information,
    if it happens to remember hashes of previous packets.

Proposal: The problem with approach 2 is that one roundtrip is spent
before the BM can be acted upon. The same roundtrip could be better
spent by performing the return routability procedure. Approach 3 is a
smart idea, and much better than approach 2 since no additional
roundtrips are needed. But it does require the mobile node to keep a
hashes of few recent packets (or start keeping hashes after one BM has
been received). Essentially the question boils down to a requirement
issue, how much do we care about random attackers in the Internet
sending BMs to mobile nodes? Is it worth the trouble, given that the
attacker still has to learn the care-of address? It also seems that
nodes who really care about this problem could use cross-layer
information as well. Other nodes will potentially suffer by having to
revert back to bidirectional routing, unnecessarily.

The recommendation is that BM messages be sent without any
authentication. We're pretty neutral about the solution,
however and comments are solicited.

---

From: Jari Arkko <[email-masked]>
Date: Fri, 03 May 2002 22:30:56 +0300

Uh, some missing text in the beginning. Here's a retry:
Background: The Binding Missing message is used in Mobile IPv6 to tell
the mobile node that the correspondent node does not have a
binding. This message is sent when the mobile node sends route
optimized traffic directly to the correspondent node and the
correspondent node has e.g. rebooted recently.

---

From: Thomas Hardjono <[email-masked]>
Date: Fri, 03 May 2002 18:03:47 -0400

Are public-key based digital-signatures completely out of the question?
Is it optional?

thomas
------

---

From: Jari Arkko <[email-masked]>
Date: Sat, 04 May 2002 01:33:10 +0300

> Are public-key based digital-signatures completely out of the question?

As in traditional strong authentication e.g. through IPsec, or as in
Cryptographically Generated Addresses?

Traditional strong authentication is not out of question. You could set
a policy on *all* your IP packets to be authenticated with IPsec, if you
had a shared secret with your CN or a trust infra.

CGA addresses... no one to my knowledge has thought yet about the
use of CGA for this particular purpose but let's think about it.
...Thinking... it seems that if the CN had a CGA address it could
easily construct error messages with a proof of authenticity.
Just sign the message with the private key associated with the CN's
address. There's been a discussion elsewhere on potential Secure
Neighbour Discovery mechanisms for IPv6, and this use reminds me of
a potential CGA application in that space.

Jari

---

From: Francis Dupont <[email-masked]>
Date: Sat, 04 May 2002 16:06:57 +0200

=> I have a concern with this second usage because the security
requirement should not be the same.

=> fine for the main usage.

=> fine for unrecognized MH Type field.

=> agree.

Regards

[email-masked]