Subject: Re: [Mip6] Review of draft-irtf-mobopts-ro-enhancements-00.txt

From: Francis Dupont <[email-masked]>
Date: Tue, 07 Jun 2005 12:39:00 +0200

In your previous mail you wrote:

=> I agree with your main comment, for instance the security of RR
was already well analyzed and should not be reproduced in the document.
   
   Section 2.0: I believe Pekka Nikander has a MIP6 WG draft
   (draft-ietf-mip6-ro-sec-02.txt) that discusses many of the issues that are
   discussed in this and subsequent sections. This draft should be referenced
   somewhere here.
   
=> the example itself (:-).

   Section 2.3, 2nd last para: I was looking here for the standard "ingress
   filtering will handle redirection-based DoS attacks" here, and the
   refutation of why that isn't practical. It might be useful to put in a
   forward reference, since it is dealt with later in the paper.
   
=> note that my argument about the ingress filtering is not this one.

   Section 3.2, end of 1st para: The impact on the core Internet of
   bidirectional tunneling is actually quite minimal given the amount of dark
   fiber left over from the Boom. It has been estimated that less that 10% of
   the cross-continent fiber in North America is lit, and the number is
   probably similar for intercontinental and other long distance links in other
   countries.

=> soem kind of "the Internet is ultra-metric" argument?
(d(A,B) + d(B,C) = d(A,C))
   
   Section 3.2, 6th para: This paragraph misses the issue of CRL checks. These
   could be a significant issue when using certificates for route optimization
   security.
   
=> note the CRL check issue is a property of some PKIs, including X.509
as it should be used...

   Section 3.2, 9th para: In my mind, the primary argument against depending on
   ingress filtering is that there is no incentive - financial, regulatory, or
   legal - for ISPs to deploy it.

=> as you said after this is true for any global Internet security device.

   A diligent ISP will of course do so, but a
   corrupt ISP might even have a financial incentive to not deploy it, if
   redirection-based DoS attacks using route optimization ever become possible
   and are exploited for financial gain. This has been an issue with spam, for
   example. I think something to that effect needs to be said. While some
   people might be offended by this, the need for security in the Internet
   results from the fact that, lacking any incentives to the contrary, some
   people will do bad things if they can get away with it and it can result in
   financial gain. Most discussions of security ignore this basic fact of human
   nature, and treat the problem like solar physics or something.
   
=> I fully agree but your argument works only against the "ingress
filtering will save MIPv6" thesis, not against my "without ingress
filtering we have no defense against flooding attacks with or without
MIPv6". The current situation unfortunately supports mine with the
everyday DDoS attacks using "botnets", and if today the issue is for
IPv4, IPv6 is a worse case because the lack of support for ingress
filtering BCPs (with a plural because BCP84/RFC3704 is more critical
for the IPv6 way to support multi-homing).

   The argument you advance
   later in the paper that the attacker can still mount an attack on the subnet
   is irrelevent. An attacker can do that without using route optimization, by
   creating a zombie and programming it to iterate through non-existant
   addresses in the victim subnet.
   
=> note this is in fact an instance of my argument in favor of
the ingress filtering!

   Section 6.3.2: final, all-encompassing method -> widespread method
   Actually, I disagree with this conclusion. I think the current crop of
   limited applicability RO security protocols are likely to die from lack of
   implementation and interest and a next gen protocol, possibly including CGA
   and CBA, that is widely applicable and a big improvement on RR is likely to
   have more success.
   
=> I don't know: when I ask friends about their interest into RO deployment
(I control the implementation point :-), the two common concerns are the
lack of security of RR and the complexity of CN code. There are some
limited applicability ROs which answer to both but they have limited
applicability... I believe CGA or something equivalent (but without CBA
which gives nothing real in exchange of its extra complexity) is the
last chance of RO, but do we need RO?

   Section 6.3.2: One issue that I've never really seen dealt with is whether
   or not RO is really needed.

=> this is the question we should not ask because we are afraid of its
possible answer (:-).

   Nobody has measured this. Skype seems to get by
   with lots of indirect routes For example, our experiments show that when we
   make a Skype call from one node in our San Jose lab to another, it goes
   through a supernode in Europe, yet the quality of the call is fine.
   Everybody seems to be assuming this is a problem, but nobody seems to have
   set up a network and actually measured whether it is *really* a problem,
   with MOS scores, etc.
   
=> bi-tunneling has still good security properties: it can be made very
secure (encrypt everything) and provide location privacy. Perhaps we
should put our effort on the basic MIPv6/NEMO support. I believed there
was no good business cases for MIPv6, mainly because computers are not
designed to be mobile, and smaller devices worked better without IP.
But today I believe MIPv6 is better than depending in WLAN & co security:
 + unified framework
 + easy vertical handoff support
 + good performance on handoffs (.5 RTT vs re-auth nightmare)
 - no DoS protection but 802.11i for instance has none too...
has 3GPP2 already what I am thinking to?

Regards

[email-masked]

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: "James Kempf" <[email-masked]>
Date: Tue, 7 Jun 2005 09:35:58 -0700

> (d(A,B) + d(B,C) = d(A,C))

I'm not sure this is always the case. If d() is inversely proportional to
network bandwidth, then suppose:

bandwidth(A,B) = 1 Gbit
bandwidth(B,C) = 1 Gbit
bandwidth(A,C) = 64 kbit

> for the IPv6 way to support multi-homing).

I don't think my argument has anything to do with MIP. My argument is:

     Because the Internet is for all intents and purposes completely
    unregulated, *any* protocol security design (MIP6, Mobike, or
    whatever) that depends on ISPs or anybody else for that matter
    behaving in a way that is public-spirited and beneficial to the
    community but which may be perverted by financial incentives
     is bound to fail.

Being a good IETFer, I dislike cops and government as much as anybody else,
but the fact is that one of the chief reasons spam continues to be a problem
is that the spammers pay off their ISPs to continue to allow them to
function (it's called a "pink letter", try googling it) while the ISPs turn
a blind eye. Would new laws and regulations coupled with some high profile
raids and convictions of ISPs help? Dunno. Maybe it would just raise the
price of the bribe, since the risk level goes up, or move the ISPs who let
themselves be bribed to North Korea.

Anyway, enough said. This is probably not the right list to discuss this
topic on.

> => note this is in fact an instance of my argument in favor of

Sure, I agree. And if all ISPs were public spirited and willing to forgoe
the extra $100,000 a month being offered by the spammers, we wouldn't have
nearly the problem with spam that we do.

> last chance of RO, but do we need RO?

I agree about CGA, perhaps coupled with CBA. Actually, I'm pretty optimistic
here. I think that *if* route optimization turns out to be worthwhile, some
of the new work will result in a security protocol that is considerably
better than RR.

> => this is the question we should not ask because we are afraid of its

Yes, interesting, isn't it? :-)

> designed to be mobile, and smaller devices worked better without IP.

Actually, I think the case is still undecided. If it turns out that route
optimization results in a 10-20% return if you are far from the POP, but
otherwise on the order of 1-2%, maybe it's not worth the extra code and
effort to implement and deploy it, but we really don't know that.

I'm really like to get some kind of measurement project together that could
measure how much of an improvement route optimization really makes in
various places around the world.

> has 3GPP2 already what I am thinking to?

Agree.

            jak

---

From: Francis Dupont <[email-masked]>
Date: Tue, 07 Jun 2005 23:23:31 +0200

> => soem kind of "the Internet is ultra-metric" argument?

=> in fact it is not ultra-metric but simply dimension one

   > (d(A,B) + d(B,C) = d(A,C))

=> to summary to go through the HA does add a delay.
   
   > for the IPv6 way to support multi-homing).
   
   I don't think my argument has anything to do with MIP.

=> I agree: my understanding of your argument is ISPs won't help
to the security of any protocol because there is no real incentive.

       My argument is:

=> so the protection against DDoS is bound to fail. I apply your
argument to MIPv6 because the security target of MIPv6 is not to be
perfect but to simply be not worse than IPv6. For flooding/DDoS
and ingress filtering is a case of shared success (or shared fate).

=> I believe the situation is better for ingress filtering than for spam
because ingress filtering is something really controlled by ISPs. IMHO
we only need good ingress filtering support in routers (I'd like to add
this in the IPv6 ready logo program with things like RFC 3871, i.e.,
not only test conformance but test usability in the real world) and
a strong incentive, for instance tier-1 accepting only clients with
deployed ingress filtering...

=> I disagree: to get a more secure Internet is a legitime topic even
we know the IETF can't enforce anything...

=> there are at least two cases where RO will never be interesting:
access to big servers (because the overhead of the CN support is too high)
and access to the company (i.e., the road warrior case, because the HA
is on the mandatory path). VoIP and co is not clear because the ratio
between the core and access networks is so high... Perhaps there is only
the mobile to mobile (i.e., the two Japanese in America in the same
street)?

=> I know people fond of GPS antenna to get One Way Delays... So I believe
the measures are already available: we need realitisc scenarios?

Regards