Subject: RE: [Mip4] Re: [mobile-ip] Re: New issue: 3012bis challenges in s olicited ag ent advertisements

From: "Ahmad Muhanna" <[email-masked]>
Date: Wed, 6 Aug 2003 13:19:00 -0500

Hi Pete,
Please see comments inline.

> 
> Yes, denial of service is possible for anyone that has access 
> to the channel (just flood it with traffic); however, we 
> should make every effort to ensure that our standards do not 
> introduce new possible attacks to Mobile IP registration or 
> make existing attacks any easier. I think that is what the 
> current 3012-bis document may have done, unless the 
> implementation is very careful to prevent it.
> 
>  > The robust solution in my opinion is the one which offers 
> a mechanism for  > the REAL MN to fight and recover from the 
> consequences of such attack.
> 
> Agreed.
> 
>  > Let us assume that one of these attacks happens. 
>  > RFC3012bis offers a recovery solution for the real MN.
>  > In any of the mentioned scenarios happened, the REAL MN 
> would be able to  > solicit and use the challenge received to 
> register.
> 
> The scenario I have in mind is where an attacker inserts a 
> new solicitation (or even bogus registration request) right 
> after every advertisement or registration reply to the MN.  
> This enables denial of service to the MN without requiring 
> the attacker to completely flood the channel; i.e., it is a 
> stronger kind of attack that we have opened up with the 
> Challenge mechanism.
> 
>  > The main concern is what the standard mandating, FA does 
> not send a  > previously used challenge to MN.  > FA sends a 
> fresh one in RRP or AA messages, let us leave it to  > 
> implementation with the unused challenge restriction.
> 
> We should be writing a document that enables anyone to 
> implement the specification in a robust way, even those that 
> have not participated in or seen this e-mail thread.  We 
> should not be hiding easter-eggs for deployments to trip over 
> later.  Do you really object to the note that I suggested for 
> the security considerations section?

Well, I do not see how the suggested comment provide a solution for this
problem.
As I said, we have a mechanism for recovery, which I believe enough. 
Adding this comment is ONLY delaying the effect of the attack for a period
of time.
Do not you agree?

Reagrds,
Ahmad
> -Pete

---

From: Pete McCann <[email-masked]>
Date: Wed, 6 Aug 2003 13:42:30 -0500

Hi, Ahmad,

 > Adding this comment is ONLY delaying the effect of the attack for a period

No, I do not agree.  I do not think the existing specification
provides for recovery, and I think that the mechanism I suggested
completely defeats the attack, or at least, restores the attacker to
exactly the power he had before with simple channel-flooding.  This is
because new solicitations or (invalid) registration requests do not
immediately push a valid challenge out of the currently valid set of
challenges.  This gives the MN time to receive the challenge, compute
an authenticator, and send it to the FA even though many, many
solicitations or (invalid) registration requests may have been
processed in the meantime.

Is that clear?

-Pete

_______________________________________________
Mip4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip4