Subject: Re: [mobile-ip] RR and BU to HA

From: Samita Chakrabarti <[email-masked]>
Date: Thu, 23 May 2002 17:38:44 -0700 (PDT)

>    > => so the COA RR check should be necessary for HA too???
>    
>    Can you explain the scenarios of threats when the MN is using IPsec with
>    non-null authentication  to send BU to a home-agent (HA) ?
>    
> => the only remaining threat is:
>  - the MN puts the address of V in the COA
>  - the HA trusts the MN which has protected the COA with IPsec
>    (so only a malicious MN can perform this attack)
>  - the traffic for the MN intercepted by the HA and the traffic for the MN
>    genuine to the HA flood the victim V
>  (the second kind of traffic is the CN reflexion attack but both:
>    - the HA has no way to verify the COA: it must trust the MN
>    - packets forwarded by the HA is added to genuine packets)

Ok. Yes in this case, the threat exists. But this can only happen when
the genuine MN already has registered with the HA at that time, so
that the packets for the malicous MN gets tunneled to the genuine MN.
If the genuine MN does not have a BCE, then it's not MIPv6 really, as
there is no tunnel to the COA V.

Security comes at a cost. For more security, MN-HA tunnel could be
IPsec secured while security association may depend on home-addr.

We could also restrict that a MN must not use more than *one* home-adress
per COA.
Thus the implementation can check (while processing BU), if there
is already an existing BCE with a different home-addr for the same
COA, then discard the packet. (implementation specific)

> Hence my conclusion:
>  - either we drop Mobile IPv6 until AAA infrastructure is available

This is not a good idea. Instead the draft can recommend using AAA
infrastructure for tighter security.

>  - or we accept the HA trusts its MNs (this can be viewed as the
>    authorization to use a service, cf. Mike Thomas' message).
> 

Yes. This is much better option. Having RR on MN-HA registration would
be a overkill, MIPv6 has already too many signaling messages.

> => no, if you'd like to register your previous care-of address in a HA
> on the previous visited link in order to get "flying" packets to this
> previous care-of, then you have two HAs...

We don't necessarily need two HAs. A MN can move from one visited link to
another and direct it's HA to forward 'flying packets' for it's old COA to 
this new COA. Although, I think mostly MNs would be okay without
this COA packet forwarding in practice.

Thanks,
-Samita

---

From: Francis Dupont <[email-masked]>
Date: Fri, 24 May 2002 14:31:04 +0200

=> no, I assume the MN itself is malicious.

=> I don't believe this is necessary and/or desirable.

   
=> until I read Alper's message, I believe the only proof of the COA
we can get was RR as in 5.5.5 and AAA. But we can use at the cost
of an extra exchange a simple return-routability check... So I've
changed a bit my opinion.   

   
=> my proposed implementation of Alper's idea has a clear security/number
of exchanges trade-off and the choice to initiate the check is in the hands
of the HA, the trusting entity. So as an option I "vote" for it.   

   
=> argh, I should have specified the `flying packets' are between the HA
and the old COA. IMHO we should forget this `smooth' hand-off for this time.

Regards

[email-masked]