Subject: RE: [Mip4] review: draft-ietf-mip4-faerr-01.txt

From: [email-masked]
Date: Wed, 21 Sep 2005 08:10:15 -0700

Hi Charlie.

> >   order to reduce the vulnerability to such maliciously transmitted
> >   Registration Reply messages with the unauthenticated 
> extension, the
> >   mobile node MAY delay processing of such Registration 
> Reply messages
> >   for a short while in order to determine whether another authentic
> >   Registration Reply might be received from the true foreign agent.
> >
> > To give priority of accepted over denied replies, reworded:
> >
> >   order to reduce the vulnerability to such maliciously transmitted
> >   Registration Reply messages with the unauthenticated 
> extension, the
> >   mobile node MAY delay processing of such denied 
> Registration Reply 
> >messages
> >   for a short while in order to determine whether another successful
> >   Registration Reply might be received.
> >  
> >
> O.K.  I made this change.  Unless I missed something, it only 
> consists of adding the single word.
> 

Changed "authentic" to "successful" AND removed "true" in front of
foreign agent.

> > 
> > Note, that this allows a rogue node to blackhole a MN's session by 
> >sending  registration reply without FA error ext, when the 
> real FA is 
> >denying the  registration.  But this is better than rogue 
> node forcing 
> >MN to deregister  after successful registration.
> >  
> >
> Maybe it's time to resuscitate some ideas from a long time ago.
> At one time I had a draft which specified how a home agent 
> could fashion a key for a MN-FA security association and send 
> it along with the registration reply.  It's not perfect, but 
> it would prevent problems like this.  I reckon it would be a 
> pretty good improvement overall.
> 

This is the case when there is also FA-HA SA along with mandatory MN-HA
SA?  If this is the case, then should be easy for HA to derive and send
out the MN-FA SA.  Not sure if you are saying that this function should
be specified in this draft or another?

Kent

> Regards,
> Charlie P.

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: "Charles E. Perkins" <[email-masked]>
Date: Wed, 21 Sep 2005 18:35:29 +0300

Hello Kent,

>Changed "authentic" to "successful" AND removed "true" in front of
Done.

>be specified in this draft or another?
No, I am definitely not suggesting to insert such a thing in this draft.

The point would be to have some security association to use that was
derived from information not available on the air interface of the
foreign agent.  You are right that it can be made much more secure
if there is already a FA-HA security association, but it is still an
improvement even when there is no such FA-HA security association.

Regards,
Charlie P.