Subject: [nemo] Security considerations for NEMO?

From: Greg Daley <[email-masked]>
Date: Mon, 30 Jun 2003 17:00:59 +1000

Hi All,

I've not heard any responses to Thierry's request for
NEMO security analysis?

Is anyone working on this now?

How about we look at issues in 3 areas:

Attacks on the MR at the visiting network
(similar to MIPv6 host issues, although
there may be further consequences for a
network).

Attacks on the NEMO's Resources,
(i.e, Bidirectional tunnel bandwidth,
routing attacks)

Attacks on nodes within a NEMO (are there any
special attacks?)

Are there any further areas to look at?

It may not look like a particularly interesting
area with the basic-NEMO solution, but we need a
basic security analysis before we can tackle RO.

Greg

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Mon, 30 Jun 2003 08:34:30 +0100

> -----Original Message-----
> From: Greg Daley [mailto:[email-masked]]
> Sent: lundi 30 juin 2003 09:01
> To: [email-masked]
> Subject: [nemo] Security considerations for NEMO?
> 
> Hi All,
> 

Hi Greg :)

> Is anyone working on this now?

I wrote some thoughts here and there, including RRH draft, but not
really.

One point that's not seen as an attack is related to anonymity. Could
the visitor and the visited entertain an 'anonymous' relationship. We
had that discussion with Alex (and you if I remember :) some time ago.

> there may be further consequences for a

Maybe the assumption that the egress can not be an ingress network as
well will not stand too long. If so, the visited link integrates the
mobile network, leading to new problems. But in basic-NEMO, I expect
that the MR behaves as a MIP MN so it inherits from the related threats.

On top of that, the MR is still a router. When it autoconfigures a
CareOf, it also adds connected routes to its Routing table. Which can
lead to attacks. So you're right, we have to consider this...

> (i.e, Bidirectional tunnel bandwidth,

Man in the middle, leaks... 

Do we need to mandate ESP or is there a simplest way, what limitations?

> Attacks on nodes within a NEMO (are there any

Big surprise, yes! And a lot of SeND / CGA related work should be
considered.

> Are there any further areas to look at?

Attacks on the HA and the home.

- Can we afford to tunnel everything from ingress of MR to HA?

- What policy on the HA for MR-HA tunneled packets?

- Where should the HA be placed, in DMZ or something? 

> basic security analysis before we can tackle RO.

I'd say that RO solutions may change the problem set; from RRH
experience, RRH removes some threats and creates new openings. So it may
well be difficult to separate RO and security.

But sure, it's good to understand the limits of basic-Nemo

Pascal