Subject: RE: [Monami6] RE: CoA verification for HA

From: Sam Xia <[email-masked]>
Date: Fri, 17 Aug 2007 17:45:21 +0800

Hi Ben

> 
> Hi Sam,
> 
> > > [snip]
> > > > This problem is not specific to monami6, but more general
> > > issue of MIP6.
> > > [Ben] Not really. I feel the issue should be view as so:-
> > >
> > > 1) Degree of threat.
> > > In MIP6, an attacker can only launch a single DoS attack. But in 
> > > Monami6, due to multiple CoA bindings support, an attacker can 
> > > launch multiple DoS attack.
> > >
> > > 2) Form of threat.
> > > In MIP6, once the attacker launch the DoS, the attacker loses 
> > > communication means (as the HoA, CoA binding is taken up for 
> > > attack). However, in Monami6, one of the multiple CoAs 
> can be used 
> > > by the attacker to control the DoS attack for the other CoA 
> > > bindings. (e.g. set filter rules at HA)
> > 
> > Sam> Yes. In monami6, attacker can lauch more attack than 
> in mip6. But 
> > Sam> I
> > think that it is a general issue for mobile IP.  The real 
> question is 
> > that even HA has authenticated with MN, how can HA believe the
> >             CoA in BU is actually belonged to MN. I agree 
> that it is a 
> > issue, not solved by mip6.
> [Ben] You seem to left out the fact that in Monami6, an 
> attacker can still be contactable via HoA. This by virtue is 
> not something that cannot be achieved in MIP6. I illustrate 
> with an example.
> 
> An attacker initiates a download for a big file to his MIP6-MN.
> Concurrently, MIP6-MN sends BU to HA changing the CoA to a 
> victim's CoA.
> Thus, victim is flooded with useless packets. Now to deny 
> service to an organization, the attacker needs an army of 
> MIP6-MN to perform such attack in order to shut the system 
> down. Similarly, all MIP6-MN cannot use their HoA for 
> communication now as it is being used for the attack.
> 
> However, if the attacker was using a Monami6-MN, all the 
> attacker needs to do is to maintain 1 CoA binding with HA (to 
> control where the flows go) and create other CoA bindings 
> that belong to victims. All this can be done by just using a 
> single MN as opposed to the army of MNs need when MIP6 is used.
> Also, the attacker can still use HoA for communication with 
> other nodes (as it can setup up flow filtering rules at HA to 
> direct the flows from other
> nodes)

I know what you do mean. there is a bit difference between Monami6 and MIP6.
But I still think that it is a general issue that is how to authenticate
CoA. right?

> 
> > Of course, if coa and hoa are both CGA, verification could be 
> > performed.
> [Ben] I'm not really familiar with CGA, but I thought CGA was 
> more for address authenticity and not address reach-ability.

Sure, CGA can do this. When CoA is CGA, MN can not bind fake CoA to its HoA.

> 
> > 
> > >
> > > > However, I'm not sure this is real scenario, because MN
> > > must establish
> > > > SA before sending BU... MN is always identified by HA
> > > before sending BU.
> > > [Ben] The CoA used for binding at HA need not be the 
> source address 
> > > of the BU. i.e. AltCoA option, BUI option. So does this means HA 
> > > should trust the CoAs in such options?
> > 
> > so, what do you want to do?
> [Ben] Like I said in the first mail, I'm asking if such issue 
> should be documented into the analysis draft. Of course if 
> the WG feels that such issue needs to be addressed, solution 
> discussion can be done via the ML.
> 
> Regards,
> Benjamin Lim
> 
> > Regards,
> > Sam.Xia.
> > 
> 
> 
> 
> 

_______________________________________________
Monami6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/monami6

---

From: RYUJI WAKIKAWA <[email-masked]>
Date: Sat, 18 Aug 2007 15:37:15 +0900

Hi Sam and Benjamin

> But I still think that it is a general issue that is how to  

agree.

>> discussion can be done via the ML.

I am not sure this is issue, but it may be useful to warn this  
scenario in analysis.
That's fine to me.

regards,
ryuji

---

From: "Benjamin Lim" <[email-masked]>
Date: Mon, 20 Aug 2007 10:20:38 +0800

Hi Sam,

[snip]
> But I still think that it is a general issue that is how to authenticate
[Ben] It could be seen that way. Although I feel that the degree of issue is
more specific to Monami6.

> Sure, CGA can do this. When CoA is CGA, MN can not bind fake CoA to its
HoA.
[Ben] I understand now.

Regards,
Benjamin Lim

---

From: Chan-Wah Ng <[email-masked]>
Date: Mon, 20 Aug 2007 11:00:47 +0800

On Sat, 2007-08-18 at 15:37 +0900, RYUJI WAKIKAWA wrote:
[snipped]
> I am not sure this is issue, but it may be useful to warn this  

Speaking as co-author of the monami6-mip6-analysis draft, I also think
that it will be useful to add this consideration into the draft.

/rgds
/cwng