Subject: RE: [nemo] Security considerations for NEMO?

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Mon, 30 Jun 2003 08:34:30 +0100

> -----Original Message-----
> From: Greg Daley [mailto:[email-masked]]
> Sent: lundi 30 juin 2003 09:01
> To: [email-masked]
> Subject: [nemo] Security considerations for NEMO?
> 
> Hi All,
> 

Hi Greg :)

> I've not heard any responses to Thierry's request for
> NEMO security analysis?
> 
> Is anyone working on this now?

I wrote some thoughts here and there, including RRH draft, but not
really.

One point that's not seen as an attack is related to anonymity. Could
the visitor and the visited entertain an 'anonymous' relationship. We
had that discussion with Alex (and you if I remember :) some time ago.

> 
> How about we look at issues in 3 areas:
> 
> Attacks on the MR at the visiting network
> (similar to MIPv6 host issues, although
> there may be further consequences for a
> network).
> 

Maybe the assumption that the egress can not be an ingress network as
well will not stand too long. If so, the visited link integrates the
mobile network, leading to new problems. But in basic-NEMO, I expect
that the MR behaves as a MIP MN so it inherits from the related threats.

On top of that, the MR is still a router. When it autoconfigures a
CareOf, it also adds connected routes to its Routing table. Which can
lead to attacks. So you're right, we have to consider this...

> Attacks on the NEMO's Resources,
> (i.e, Bidirectional tunnel bandwidth,
> routing attacks)

Man in the middle, leaks... 

Do we need to mandate ESP or is there a simplest way, what limitations?

> 
> Attacks on nodes within a NEMO (are there any
> special attacks?)
> 

Big surprise, yes! And a lot of SeND / CGA related work should be
considered.

> Are there any further areas to look at?
> 

Attacks on the HA and the home.

- Can we afford to tunnel everything from ingress of MR to HA?

- What policy on the HA for MR-HA tunneled packets?

- Where should the HA be placed, in DMZ or something? 

> It may not look like a particularly interesting
> area with the basic-NEMO solution, but we need a
> basic security analysis before we can tackle RO.
> 

I'd say that RO solutions may change the problem set; from RRH
experience, RRH removes some threats and creates new openings. So it may
well be difficult to separate RO and security.

But sure, it's good to understand the limits of basic-Nemo

Pascal

---

From: Greg Daley <[email-masked]>
Date: Tue, 01 Jul 2003 11:17:54 +1000

G'Day Pascal,

> had that discussion with Alex (and you if I remember :) some time ago.

I believe I remember it.   I think I was
talking about using AAA, so privacy from
the NEMO wasn't my focus at the time.

I think that Basic NEMO allows a limited
knowledge environment to exist (for example,
the visited network needn't know that a
device is an MR), nor does a visitor know
that it is on a NEMO (necessarily) but still
guess that AAA or PKI will be used to
authorize visitors.

SEND seems to allow some security without
necessarily divulging identities
(if CGA is used).  I'm not exactly sure how
all this works with RO though.

Did you have a separate draft on visitor
anonymity?

> lead to attacks. So you're right, we have to consider this...

It may be relatively simple in basic NEMO, though.

> Do we need to mandate ESP or is there a simplest way, what limitations?

Obviously tunnel MTUs are an issue.
If there's a problem with ICMP Too Big
reception then DoS occurs...

> Big surprise, yes! And a lot of SeND / CGA related work should be

I agree, Although I think that CGA is over-rated
when the routing infrastructure is not able
to be implicitly trusted (as in NEMO).

> - Can we afford to tunnel everything from ingress of MR to HA?

I think we have to determine what circumstances this will
occur under...

I think that we have to look at the Basic NEMO case
as the main issue (at least initially).  Nesting may
exacerbate this though.  Is there a way that MRs know
that they are being nested?

> - What policy on the HA for MR-HA tunneled packets?

Are we talking Basic or RO?

> - Where should the HA be placed, in DMZ or something? 

This is worth consideration.  I think that if we're
talking about Basic NEMO with bidirectional IKE/ESP tunnels,
then we have no greater risk to the network from
attacks occurring on the NEMO from the Internet.
We're possibly providing carriage for untrusted hosts
though, which significantly changes how we'd handle things
compared to MIPv6.

> But sure, it's good to understand the limits of basic-Nemo

I think that any RO solution will have to interwork
with Basic NEMO.  The presence of a strong security
analysis (of basic, initially) will help with that.
I can't see that investigating RO security is as
worthwhile (except on a per RO method basis) until
the WG decides to pursue the issue and is happy
with the general form of Basic NEMO (This may be
accomplished, although we need to address IPR fears)

I'll try to read Souwhan's draft soon, and we can try to
get some discussion going.

Greg

---

From: Greg Daley <[email-masked]>
Date: Tue, 01 Jul 2003 11:17:54 +1000

G'Day Pascal,

Greg