Subject: Re: [Mip6] A Question on Mobile IPv6 -- Alternate Care-of Address option

From: Gregory Daley <[email-masked]>
Date: Fri, 14 Nov 2003 06:56:47 +1100

Dear Jee,

----- Original Message -----
From: "Jee J.Z." <[email-masked]>
Date: Friday, November 14, 2003 5:42 am
Subject: [Mip6] A Question on Mobile IPv6 -- Alternate Care-of Address 
option

> Dear all,
> 
> May I ask a question on MIPv6:
> 
> About the Alternate Care-of Address option, in 5.2.6
> (draft-ietf-mobileip-ipv6-24) it reads:
> 
> "...However, a different care-of address MAY be specified by 
> including an
> Alternate Care-of Address mobility option in the Binding Update 
> (see Section
> 6.2.5).  When such a message is sent to the correspondent node and the
> return routability procedure is used as the authorization method, the
> Care-of Test Init and Care-of Test messages MUST have been 
> performed for the
> address in the Alternate Care-of Address option (not the Source
> Address)...."
> 
> And in 6.2.5 it reads:
> 
> "...Normally, a Binding Update specifies the desired care-of 
> address in the
> Source Address field of the IPv6 header.  However, this is not 
> possible in
> some cases, such as when the mobile node wishes to indicate a care-of
> address which it cannot use as a topologically correct source address
> (Section 6.1.7 and Section 11.7.2) or when the used security 
> mechanism does
> not protect the IPv6 header (Section 11.7.1)...."
> 
> Since the Alternate Care-of Address is only valid in Binding 
> Update message,
> how can the Correspondent Node know this alternate Care-of Address 
> whenperforming return routability procedure?
> 

HMIPv6 uses this option.  Also, If a host already has a
currently performed return routability procedure for a CoA
(for example, it has decided to change back to a previously
visited network) it may desire to perform the BU before
it leaves in order to reduce handover latency.

I'm not sure how realistic this scenario is, but in this case,
an Alternative CoA is required.  I'm not sure if anyone except
HMIPv6 uses this option in reality though.

Greg 

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Nicolas Montavont <[email-masked]>
Date: Thu, 13 Nov 2003 23:31:41 +0100

>it leaves in order to reduce handover latency.
It is an interesting scenario, but how to determine the timing on when 
you really go back to the old network ? Further, how can be sure that 
your address is still valid in your old location ?

Another scenario can be a scenario of multihoming: consider that you 
have two interfaces and wants to use one for signalization and the other 
one for the data packets.

Nicolas

---

From: "Jee J.Z." <[email-masked]>
Date: Thu, 13 Nov 2003 22:43:08 -0000

Hi Greg and all,

Thank you for your reply. I don't doubt there would be cases in which we
should use the Alternate Care-of Address option, such as those you stated
and stated in section 6.2.5 in draft-ietf-mobileip-ipv6-24 (for convenience
I list it below again).

        "...Normally, a Binding Update specifies the desired care-of address
in the Source Address field of the IPv6 header.  However, this is not
possible in some cases, such as when the mobile node wishes to indicate a
care-of  address which it cannot use as a topologically correct source
address  (Section 6.1.7 and Section 11.7.2) or when the used security
mechanism does   not protect the IPv6 header (Section 11.7.1)...."

What I am wondering is when return routability procedure is used before the
BU (with the Alternate Care-of Address option) is sent, how could the
Care-of Test Init and Care-of Test messages be performed for the address in
the Alternate Care-of Address option? Correspondent node can't get the
alternate care-of address through the Care-of Test Init, can it? Thus the
Care-of keygen toden is not calculated based on the alternate care-of
address. I am still confused. Thank you.

Jee

----- Original Message ----- 
From: "Gregory Daley" <[email-masked]>
To: "Jee J.Z." <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, November 13, 2003 7:56 PM
Subject: Re: [Mip6] A Question on Mobile IPv6 -- Alternate Care-of Address
option

---

From: Greg Daley <[email-masked]>
Date: Mon, 17 Nov 2003 15:26:24 +1100

Nicolas Montavont wrote:
[part cut]
> your address is still valid in your old location ?

I'd guess that if you used a near-randomly generated address such
as a CGA or a 3041 address, the address is unlikely to be claimed
in your absence.

I'd guess that you'd know if you were going back to the old network
if you had some external knowledge about the quality of the signal,
or you were returning to the same geographic location where you
were connected before (and received good service then).

> one for the data packets.

Indeed.  This is actually more likely to be of use, but in this
case, return routability needs to be done from the new CoA to prove
the identity of the host's interface.

If there didn't need to be any signalling from the new access
interface, this could be a great advantage, if the new
link is constrained or costly.

With a stronger security association it is plausible that
you could trust someone anyway even without a prior COT/I exchange but 
even HMIPv6 requires an online-care-of-test in this case.

Greg

---

From: Greg Daley <[email-masked]>
Date: Mon, 17 Nov 2003 15:29:59 +1100

Hi Jee,

> address. I am still confused. Thank you.

You're right,

the CoT/I exchange may be required currently for MIPv6.

In HMIPv6 this is OK, if we want to send the alt-coa BU
from the on-link care-of-address of the MN.  the RR has to
be done over the MAP tunnel though.

Greg

---

From: Tobias Küfner <[email-masked]>
Date: Tue, 18 Nov 2003 11:04:25 +0100

Dear Greg,

> be done over the MAP tunnel though.

I don't really understand the motivation for using 
the alternate CoA option in HMIPv6. Please, help me.

If the MN can't use its RCoA as a topologically 
correct source address, (1) it must send/receive CoTI/CoT 
over MAP tunnel and (2) the payload packets from/to the
CN must also be tunneled by/to the MAP.

So what is the benefit from sending the BU *directly*
to the CN [HA] using the LCoA as source address?

I can't find any situation in the HMIPv6-draft in which
the MN "SHOULD" or "MUST" use the alternate CoA option.
Do such situations exist?
If so, would you give me examples, please?

Sorry, if I'm missing something obvious.

Tobias
_____________
Tobias Küfner
Institute of Telematics, University of Karlsruhe, Germany

---

From: Greg Daley <[email-masked]>
Date: Wed, 19 Nov 2003 10:51:33 +1100

Hi Tobias,

> CN must also be tunneled by/to the MAP.

This issue is related to what is being discussed on the
MIPSHOP list about HMIPv6 source address selection.

You're right, that if reverse tunneling is available,
that may be used (and is necessary for RR).

> Sorry, if I'm missing something obvious.

I don't think you are.

Initially, before RR was developed, the plan was
not to use reverse tunnels in any case (they have extra
overhead).

Then, the alt-coa option was required in networks
deploying ingress filtering (not allowing P or I bits
the RCoA as packet source address).

Now the existence of RR makes this less sure, since there's
always a reverse tunnel in existence.  Of course, HA
bindings don't require RR and may therefore be sent from
the LCoA.

This may be useful if a device wants to do a HA binding
when it has not yet finished MAP binding (but expects to).

Whether this is necessary or just useful is another issue,
though.

Greg

---

From: Ryuji Wakikawa<[email-masked]>
Date: Tue, 18 Nov 2003 18:04:46 +0900

Hi Greg

At Mon, 17 Nov 2003 15:26:24 +1100,
> even HMIPv6 requires an online-care-of-test in this case.

I wrote some scenarios in draft-wakikawa-mobileip-multiplecoa-02.txt(section5.4).
With this proposal, MN can register multiple CoAs for single Hoa.

When MN sends a BU with an alternate CoA and already registers the
source address of the BU as a binding, it does not need to perform
CoTI/CoT for the alternate CoA. CN can trust the BU source address
because CN has care-of keygen token for the CoA (source address).
  
regards,
ryuji

---

From: Tobias Küfner <[email-masked]>
Date: Thu, 27 Nov 2003 11:32:24 +0100

Hi Ryuji,

I expected somebody on the mailing list would protest about your last
comment. Nobody did. So I am not sure whether I am right. IMO you miss
an important objective of the return routability procedure. 

> because CN has care-of keygen token for the CoA (source address).

To use the alternate CoA this way is not allowed in MIPv6. Section 9.5.1
says:

      Note that a care-of address different from the Source Address MAY
      have been specified by including an Alternate Care-of Address
      mobility option in the Binding Update.  When such a message is
      received and the return routability procedure is used as an
      authorization method, the correspondent node MUST verify the
      authenticator by using the address within the Alternate Care-of
      Address in the calculations.

This means the MN has to perform RR for a CoA (to get the right care-of
keygen token) before it can send an authenticated BU for this CoA to the
CN.

BUs with alternate CoA Options as described in your draft (Section 5.4,
2nd Scenario) could be used to start a DDoS attack as described in the
MIPv6-draft (Section 15.1):

      A malicious (mobile) node might also send Binding Updates in which
      the care-of address is set to the address of a victim node.  If
      such Binding Updates were accepted, the malicious node could lure
      the correspondent node into sending potentially large amounts of
      data to the victim; the correspondent node's replies to messages
      sent by the malicious mobile node will be sent to the victim host
      or network.  This could be used to cause a Distributed
      Denial-of-Service attack.

Note that the RR protects against this kind of attack (MIPv6, Section
15.4.2).

Do you agree with me?

Best Regards
Tobias

---

From: "Jee J.Z." <[email-masked]>
Date: Thu, 27 Nov 2003 23:45:56 -0000

Hi Tobias and Ryuji,

I also noticed this inconsistency which makes me somewhat confused. I didn't
raise my question because:

1. Ryuji has pointed out "CN can trust the BU source address because CN has
care-of keygen token for the CoA (source address)". This avoids the case
that a malicious node forges the BU.
2. When the MN receives a valid BACK from the CN, it proves the reachability
of the alternative care-of address in both directions.

However, it is inconsistent with MIPv6, isn't it?

Regards,
Jee

----- Original Message ----- 
From: "Tobias Küfner" <[email-masked]>
To: "'Ryuji Wakikawa'" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, November 27, 2003 10:32 AM
Subject: RE: [Mip6] A Question on Mobile IPv6 -- Alternate Care-of Address
option

---

From: Tobias Küfner <[email-masked]>
Date: Fri, 28 Nov 2003 07:52:15 +0100

Hi Jee,

I don't get your second point. 
Can you explain it, please?
How does the MN prove that it received BACK?

Tobias

> -----Original Message-----
> From: Jee J.Z. [mailto:[email-masked]] 
> Sent: Friday, November 28, 2003 12:46 AM
> To: Tobias Küfner; Ryuji Wakikawa
> Cc: [email-masked]
> Subject: Re: [Mip6] A Question on Mobile IPv6 -- Alternate 
> Care-of Address option
> 
> 
> Hi Tobias and Ryuji,
>

---

From: "Jee J.Z." <[email-masked]>
Date: Fri, 28 Nov 2003 11:15:30 -0000

Hi Tobias,

According to draft-ietf-mobileip-ipv6-24.txt, a Binding Acknowledge
includes:

* Source Address = CN
* Destination Address = care-of address -->(in this case the alternative
care-of address sent by the MN, IMO)
* Sequence Number
* HMAC_SHA1 (Kbm, (care-of address | CN address | BA))
   -->(in this case the Kbm should be calculated based on the source address
in the Binding Update; care-of address should also be the source address in
the Binding Update. This is why I said Ryuji's draft seems inconsistent with
MIPv6 draft: care-of keygen token is based on the source address, and
therefore Kbm is also based on the source address)

However, IMO these are enough for the MN to prove that it received a right
BACK. Let me know if I am wrong.

Jee

----- Original Message ----- 
From: "Tobias Küfner" <[email-masked]>
To: "'Jee J.Z.'" <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, November 28, 2003 6:52 AM
Subject: RE: [Mip6] A Question on Mobile IPv6 -- Alternate Care-of Address
option

---

From: Jari Arkko <[email-masked]>
Date: Fri, 28 Nov 2003 14:38:51 +0200

> because CN has care-of keygen token for the CoA (source address).

I'm confused. Your draft says:

    The mobile node MUST sends CoTI for each care-of
    addresses and MUST receive CoT for each care-of addresses.  The
    mobile node also generates BID for each care-of addresses to register
    them as individual bindings .  The registration step is same as
    the home registration except for calculating authenticator with
    Binding Unique Identifier sub-option as well as the other sub-options
    specified in [6].

and later:

    If the
    mobile node registers bindings to a correspondent node, it MUST
    sends multiple CoTI for multiple care-of addresses.  After getting
    CoTs, it sends Binding Updates with M flag and a Binding Unique
    Identifier sub-option for all care-of addresses one by one.

I agree with what you draft says, but I'm not sure I agree what you
wrote in the e-mail. The registration of another care-of address
does not relieve you from the need to test a new care-of address.
However, of course you need to perform the home address test just
once and you can reuse the result for multiple care-of address
registrations.

--Jari

---

From: Tobias Küfner <[email-masked]>
Date: Fri, 28 Nov 2003 13:44:50 +0100

Hi Jee,

> BACK. Let me know if I am wrong.

I don't think you're wrong. I absolutly agree with you. But we have
different attacks in mind. The attack I'm thinking of is a distributed
denial-of-service attack against a third party initiated by a malicious
(not necessarily mobile) node (as described in MIPv6, Section 15.1). I
don't think we need to protect this kind of mobile node, do you? ;-)

Best Regards 
Tobias

---

From: "Jee J.Z." <[email-masked]>
Date: Fri, 28 Nov 2003 14:13:12 -0000

Hi Tobias,

If I understand you correctly, you are saying that a previously registered
MN with the CN may be a malicious node to forge a BU with an alternative
care-of address option to the CN, and lure a large amount of traffic to
another MN (which is using the care-of address specified in the alternative
care-of address option of the forged BU) or its attached network. Right? If
so, I agree with you that the threat exists. I think we should also avoid
this kind of attacks.

Then as stated by Jari, RR must be done for each care-of address gonna be
used. Maybe we'd better wait Ryuji to clarify his intention.

Regards,
Jee

----- Original Message ----- 
From: "Tobias Küfner" <[email-masked]>
To: "'Jee J.Z.'" <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, November 28, 2003 12:44 PM
Subject: RE: [Mip6] A Question on Mobile IPv6 -- Alternate Care-of Address
option