Subject: RE: [Mip4] Re: [mobile-ip] Re: New issue: 3012bis challenges in s olicited ag ent advertisements

From: "Ahmad Muhanna" <[email-masked]>
Date: Wed, 6 Aug 2003 12:05:42 -0500

Hi Pete,
Comments inline.

Regards,
Ahmad

> 
> 
> 
> How about this for the security considerations:
> 
>   Note that an active attacker may try to prevent successful
>   registrations by sending a large number of Agent Solicitations or
>   bogus Registration Requests, each of which could cause the FA to
>   respond with a fresh challenge, invalidating the challenge that the
>   MN is currently trying to use.  To prevent such attacks, the FA
>   SHOULD repeat the same challenge value in successive unicast
>   responses to Agent Solicitations or in Registration Replies to
>   Requests that did not contain valid MN-AAA or MN-FA authentication
>   extensions for some limited period of time.  Note that each
>   challenge returned to an MN MUST be previously unused by that MN.
> 

Honestly, I am not sure if we are trying to restrict the standard for remote
attacks that is not frequently happens nor absolutely prevented.
It is usually hard to prevent any of these attacks anyway. 
The robust solution in my opinion is the one which offers a mechanism for
the REAL MN to fight and recover from the consequences of such attack.

Let us assume that one of these attacks happens. 
RFC3012bis offers a recovery solution for the real MN.
In any of the mentioned scenarios happened, the REAL MN would be able to
solicit and use the challenge received to register.
The main concern is what the standard mandating, FA does not send a
previously used challenge to MN.
FA sends a fresh one in RRP or AA messages, let us leave it to
implementation with the unused challenge restriction.

> -Pete

---

From: Pete McCann <[email-masked]>
Date: Wed, 6 Aug 2003 12:37:07 -0500

Hi, Ahmad,

See below.

 > It is usually hard to prevent any of these attacks anyway. 

Yes, denial of service is possible for anyone that has access to the
channel (just flood it with traffic); however, we should make every
effort to ensure that our standards do not introduce new possible
attacks to Mobile IP registration or make existing attacks any easier.
I think that is what the current 3012-bis document may have done,
unless the implementation is very careful to prevent it.

 > the REAL MN to fight and recover from the consequences of such attack.

Agreed.

 > solicit and use the challenge received to register.

The scenario I have in mind is where an attacker inserts a new
solicitation (or even bogus registration request) right after every
advertisement or registration reply to the MN.  This enables denial of
service to the MN without requiring the attacker to completely flood
the channel; i.e., it is a stronger kind of attack that we have opened
up with the Challenge mechanism.

 > implementation with the unused challenge restriction.

We should be writing a document that enables anyone to implement the
specification in a robust way, even those that have not participated
in or seen this e-mail thread.  We should not be hiding easter-eggs
for deployments to trip over later.  Do you really object to the note
that I suggested for the security considerations section?

-Pete

_______________________________________________
Mip4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip4