Subject: RE: [seamoby] RE: Authentication & Authorization "in-the-large" w as Re: [seamob y] ct problem statement

From: Nakhjiri Madjid-MNAKHJI1 <[email-masked]>
Date: Thu, 14 Jun 2001 16:36:47 -0500

Pat,

See below (MN>>>>)

-----Original Message-----
From: Pat Calhoun [mailto:[email-masked]]
Sent: Tuesday, June 12, 2001 6:32 PM
To: Nakhjiri Madjid-MNAKHJI1
Cc: 'Pat Calhoun'; Arthur Ross; Charlie Perkins; Kulwinder Atwal;
'seamoby'; [email-masked]
Subject: Re: [seamoby] RE: Authentication & Authorization "in-the-large"
was Re: [seamob y] ct problem statement

On Tue, Jun 12, 2001 at 05:08:48PM -0500, Nakhjiri Madjid-MNAKHJI1 wrote:
> 
> of course. My intention was not to kill the whole thread, just the
> definition wars that are going on :)
> 
> MN>> Pat, Ok so the thread lives on... Thanks, I cut a lot
> of text for readability.
> 
> > 
> > 1-How to prevent a pre-authenticated AR from doing unauthorized CT DoS.
> 
> I would claim that such events are unlikely to happen. When a user wants
to
> move
> from one service area to another, the spectrum will be overlapping. The
> operators
> of these networks will allow/disallow CT between the routers handling
these
> service areas. If they permit it, then will ensure that secure
communication
> is available between them.
> 
> MN>> I am not quite sure I understand your point. I am not sure
> how spectrum overlap comes in?

Sorry, what I meant was that the service areas are close enough that it
makes sense to CT. If there is a long no-service time between both service
areas, then CT doesn't really make that much sense, right?

MN>>>> I am still not sure how proximity prevents launching DoS attacks
by a third party pretending to be a authenticated CT-Peer, if you don't
do message authentication. 

> Anyway, seems like you are asuuming one and the same operator handling
> both oldAR and newAR.

I didn't mean to assume this.

>  What if they belong to two different operators.
> And then one operator decides to mess with the other one, by having
> its ARs that are already authenticated to its neighbor ARs (from the
> other operator) do DoS, i.e.

Right, so my point is that if CT is to occur between two ARs, they
MUST know about each other to begin with, right? If so, then a pre-existing
SA exists between the ARs, and security will ensure that no DoS attack
can exist.

MN>>>> see my comments above.

Actually, there is one way to do a DoS attack that has just come to mind,
and involves a rogue mobile sending bogus L2 messages faking handoffs, but
this doesn't just affect CT, as it would also affect the handoff procedures,
and this only exists on wireless links that are not authenticated.

MN>>>> Change the rouge MN with somebody pretending to be an AR, then
you got a case, haven't you? 

> OP1 (AR1) does a DoS on OP2(AR2) although AR1-AR2 had a
pre-authentication.

That is not really an attack that we need to consider. Once you trust one
side
of a conversation, there isn't a whole lot that you can do to protect
yourself against bad behavior (well, a good implementation can protect
itself
properly).

MN>>>> you are right, I realized later that no security measure can protect
you here, but an AR3 can come in the middle here, can't it?

Madjid

---

From: Pat Calhoun <[email-masked]>
Date: Thu, 14 Jun 2001 15:41:23 -0700

> do message authentication. 

proximity has nothing to do with DoS. My argument (if I even remember that far
back) was that CT doesn't really make a whole lotta sense if there isn't a 
fast handoff (TM) that occurs anyways. So, if the device is disconnected for
more than a second (or perhaps the number should be larger), then the benefits of
CT are questionable. Let the MN signal all over again.

PatC

---

From: "Emil Sturniolo" <[email-masked]>
Date: Thu, 14 Jun 2001 19:15:37 -0400

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of Pat Calhoun
Sent: Thursday, June 14, 2001 6:41 PM
To: Nakhjiri Madjid-MNAKHJI1
Cc: 'Pat Calhoun'; Arthur Ross; Charlie Perkins; Kulwinder Atwal; 'seamoby';
[email-masked]
Subject: Re: [seamoby] RE: Authentication & Authorization "in-the-large" w
as Re: [seamob y] ct problem statement

> do message authentication.

proximity has nothing to do with DoS. My argument (if I even remember that
far
back) was that CT doesn't really make a whole lotta sense if there isn't a
fast handoff (TM) that occurs anyways. So, if the device is disconnected for
more than a second (or perhaps the number should be larger), then the
benefits of
CT are questionable. Let the MN signal all over again.

PatC

[ES] Pat,  I think this really depends on your point of view. If one
considers the cost of the link, reducing any additional signaling may save
me $$$ in the long run, especially in a pay-per-byte mode.  Consider the
face that one would have to renegotiate the SA, compression state, etc for
every transport layer session that is established. It could represent a
significant penalty. Lets not just consider performance alone.

Cordially,
Emil Sturniolo
[email-masked]
330-723-9099 Office
330-461-0326 Mobile/Vmail
www.NetMotionWireless.com
= = = = = = = = = = = = = = =
This message contains information that
may be confidential and privileged.  Unless
you are the addressee or are authorized by
the addressee, you may not use, copy or
disclose the information contained in this
message.  If you have received this
message in error, please delete it and
advise the sender.