Subject: RE: Security stuff was RE: Comments Re: [seamoby] ct problem stat ement

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 6 Jun 2001 12:02:19 +0200

% hi thomas!
 
Hannes Tschofenig writes:
 > # hi mark!
 > 
 > What good is authorization without authentication?
 > 
 > oldAR: "Yeah, this guy is authorized."
 > newAR: "Really?  Who is he?"
 > oldAR: "Uh, he's, well, authorized."
 > newAR: "I don't buy it."
 > 
 > Maybe I'm just paranoid, but I'd like to suggest that authentication
and
 > authorization go hand-in-hand.
 > 
 > # authorization and authentication do not always go hand-in-hand:
 > # an example: 
 > # if you look at the proposals for the mn-cn binding update problem
you 
 > # will see that they all do not provide authentication but most of
them
 > # try to solve the address ownership problem - an authorization 
 > # problem. 
 > 
 > # but in most cases you are right. 

I really don't think that mipv6 address ownership
problem is the best example.
% it may not be the best example related to CT
% but it shows authorization without authentication.
 
 In fact, the
proposals that have been submitted all assert
identity, namely the IP address from whence they
came.
% they show two things:
% - the mobile node is at the current location (CoA) and
%   is therefore able to reply to a response from a CN.
% - and some proposals make use of the home agent to 
%   actively participate in the protocol.  

% additionally the existing infrastructure is used to limit
% the location of an adversary.

 Most (all?)
% the first proposal "purpose built keys" does not provide
% address ownership - the home address is never used in the 
% protocol itself
% the protocol however tries to introduce an interesting property:
% if the mobile node was once able to send the EID to the CN 
% then the CN can be sure that a BU is from the same sender. 

 of the proposals for the CN
problem depend on a return routability check as
both a check on authentication -- CN challenges,
MN responds to the challenge with the same IP
address -- and authorization -- if the MN can
respond at all, it must have been authorized by
its attachment point, and so on through the
network.

Note that this is a weak form of both
authentication and authorization (ie no strong
crypto binding), but it does try to accomplish
both goals.

% i am not quite sure if i would call this authentication because:
% if you look at a traditional authentication protocol then 
% you have either a shared secret between those two parties or
% you rely on a trusted third party (with a trust relationship
% between both entities to the TTP). 
% here we have neither a shared secret nor a infrastructure behind 
% those entities. there is no trust relationship between the CN and the
% HA (or mn's home network). 
% 
% in the mipv6 case case the best you can do with the proposed
% protocols is to 
% - limit the location of the adversary (by using an esp tunnel
%   between the HA and the MN,...)
% - and avoid passive attacks whereby the final key can be computed 
%   by eavesdropping data transmited between the MN and the CN. 
%   (hence all propals show a vulnerability against active attacks)

% hannes

	Mike

---

From: Michael Thomas <[email-masked]>
Date: Mon, 11 Jun 2001 08:44:01 -0700 (PDT)

> % but it shows authorization without authentication.

   Again, let's not confuse authentication with strong
   crypto based authentication. In fact, many thing
   use the source IP address for authentication; whether
   that's a good idea, of course, is a different question.
   With the BU problem, many (including myself) are making
   the claim that authentication based on return routability
   -- possibly with some other checks thrown in --
   is a sufficient test to authorize the BU.   

 > %   is therefore able to reply to a response from a CN.

   Right. This is an authentication challenge.

 > %   actively participate in the protocol.  
  
   Correct. This is an authentication challenge
   where the MN and HA are considered to be part 
   of a group where it doesn't matter who answers
   the query. It's still a challenge though.

 > % then the CN can be sure that a BU is from the  same sender. 

   PBK still uses a return routability test as the 
   basis of the authentication. The draft is
   somewhat elusive about that, but it's implied
   by saying that the MN and CN must exchange a 
   few messages before doing the PBK exchange.
   
 > % HA (or mn's home network). 

   Again, authentication != strong authentication. 
   There is a transitive trust relationship
   existent on the net right now. That is, if I
   forward a message, I trust that the next hop
   router will do it's job correctly, it trusts
   its next hop router will do it's job, and so
   forth. Therefore, the final router manifestly
   "owns" the subnet by virtue of the transitive
   trust relationships between the various IGP's
   and EGP's. All of the various BU security drafts
   try to take advantage of that already existing 
   transitive trust arrangement.

		Mike