Subject: Re: [mobile-ip] Unresolved issue #3: BA, BR authentication?

From: Jari Arkko <[email-masked]>
Date: Mon, 06 May 2002 02:30:04 +0300

I'm trying to finish the discussion on the BA/BR authentication.
Let me try to capture the opinions as I understood them. First
the things we seem to agree on:

* Binding Request doesn't need any authentication. Sending
   spoofed CN traffic to the mobile node's home address
   accomplishes the same thing, make it look like the CN
   does not have a BCE.

* Some authentication is needed for the Binding Acknowledgement.
   Otherwise, it may be possible to get the MN traffic blackholed,
   or RO turned off too easily.

* Original Kbu did not offer any authentication in the CN->MN
   direction, because someone could have spoofed HoT, CoT.

Then the remaining differences:

* Erik and Vijay think that a sequence number suffices for
   BA instead of a real cookie. Tuomas thinks that sequence
   numbers are too guessable.

* Tuomas and Jari think that a cookie alone would be sufficient
   for BA authentication, and Kbu should not be used due to the
   complexity it brings for the analysis of the security of RR.
   They acknowledge however that Kbu authentication does bring
   an additional level of security, mainly against attackers on
   the CoA link (which may not matter if these attackers can
   perform other attacks anyway). Vijay thinks Kbu authentication
   is also needed.

How should we move forward, then? I'd like to propose the
following compromise:

1) Sequence numbers can be used, but their initialization will
    be required to be random.

2) We will not use Kbu for BAs.

3) No BR authentication.

Jari

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 6 May 2002 22:36:36 +0200 (CEST)

>    numbers are too guessable.

I think something stronger than a sequence number is fine as well.

>     be required to be random.

I personally think it would be better to have an explicitly
random cookie and let the sequence numbers start at zero.

> 2) We will not use Kbu for BAs.

OK

> 3) No BR authentication.

OK

  Erik

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 06 May 2002 14:49:32 -0700

hi Jari,

A few comments,

>    numbers are too guessable.

Thats why I said Kbu helps here. Even if the sequence number
is guessable, the attacker cannot generate MAC_Kbu over the
binding ack (unless he knows the Kbu). 

>    complexity it brings for the analysis of the security of RR.

Sorry, I dont remember this. What additional complexity? Can
you please elaborate?

>     be required to be random.

Fine with me.

> 2) We will not use Kbu for BAs.

Fine with me, if you tell me what the additional complexity is.
I am all for simplification.

> 3) No BR authentication.

cool.

regards
Vijay

---

From: Jari Arkko <[email-masked]>
Date: Tue, 07 May 2002 02:11:45 +0300

> Sorry, I dont remember this. What additional complexity? Can

There isn't much additional implementation or specification complexity,
just use the same Kbu in the ack, add a MAC... but the worry was about
the ability to understand the RR protocol and its properties. A cookie/seqno
returned in an ack is understandable to everyone, but figuring out exactly
what does Kbu buy or not buy in the ack is not trivial. This would make it hard to
analyze whether the protocol has surprising problems, or what the exact
security level is. Also, engineers taking a quick look at the protocol
might be fooled into believing there is more security than there really
is.

In any case, we seem to agree on what to do, so...

Jari

---

From: Vijay Devarapalli <[email-masked]>
Date: Mon, 06 May 2002 18:18:16 -0700

> might be fooled into believing there is more security than there really

Jari,

I dont agree that engineers would be fooled as you describe. I think 
they are much smarter!!. Having the MAC_Kbu with the BA would eliminate 
the need for random initialization for the sequence number. It can be 
as it used to be. I would appreciate it, if the sequence number is left 
as it is now.

regards
Vijay