Subject: RE: [Mip4] Re: LC review: draft-ietf-mip4-dynamic-assignment-05.txt

From: "Milind Kulkarni \(mkulkarn\)" <[email-masked]>
Date: Thu, 8 Sep 2005 15:06:31 -0700

-----Original Message-----
> From: Ahmad Muhanna [mailto:[email-masked]] 
> Sent: Monday, September 05, 2005 9:35 AM
> To: Henrik Levkowetz
> Cc: Kent Leung (kleung); Joel M. Halpern; Pete McCann;
<[email-masked]>; Milind Kulkarni (mkulkarn); Margaret Wasserman; >
Alpesh Patel (alpesh); Mohamed Khalil
> Subject: RE: [Mip4] Re: LC review:
draft-ietf-mip4-dynamic-assignment-05.txt
>
>>
>> [Henrik]
>> Thanks for the pointer.  In that case, unless anybody can propose a 
>> mitigation, I'd propose that we document this in the security 
>> considerations and leave it at that.
>
>[Ahmad]
>I am ok if there is a consensus on this.
>
----- End Original Message-----

Hello all,

In order to make progress on this issue, I am proposing following
additional text. Please provide your comments/suggestions.

9. Security Considerations 

"There is a possibility of having more than one HA creating a mobility
binding entry for a given MN, if a man in the middle captures the RRQ
and forwards it to different Has in the network.  However, this scenario
assumes that the rogue node has the capability to store and duplicate
packets, and can find out addresses of the HAs in the network.  Time
window of this scenario is limited to only within the replay window -
otherwise the HAs will reject the Registration Requests anyway.  A
Mobile Node may choose to minimize the risk of this scenario by sending
deregistrations to the HA from which the additional registration replies
are received after a successful registration."

12. Acknowledgements 

"Thanks to Ahmad Muhanna for pointing out possible scenario, documented
in the Security Considerations section, of more than one HA creating a
mobility binding entry for a given MN."

Thanks,
Milind

-- 
Mip4 mailing list: [email-masked]
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/

---

From: Henrik Levkowetz <[email-masked]>
Date: Fri, 09 Sep 2005 02:43:10 +0200

Hi Milind,

> are received after a successful registration."

Good as far as it goes, but I'd prefer to also add a SHOULD regarding MN
de-registration of additional replies earlier in the document, where MN
behaviour is discussed.

	Henrik