Subject: [Mip6] Blocking Authentication Data After De-Registration

From: Christian Vogt <[email-masked]>
Date: Mon, 17 Apr 2006 02:45:01 +0200

Hi everybody.

Section 9.5.3 of RFC 3775 specifies that, when a MN de-registers with a
CN, the CN must block the combination of HoA, CoA, seqno, and nonce
indices as it was used for the creation of the existing BC entry.  The
blocked combination must be kept for at least the smaller of the
remaining lifetimes of the associated nonces.

The purpose of this rule is to prevent replay of an intercepted Binding
Update message after sequence-number state is lost due to the MN's
de-registration.

An issue with this rule is that a CN generally does not only keep a
single valid nonce, but a small number of valid nonces.  An attacker may
hence intercept a Binding Update message that was authenticated with
nonce A, while the CN would block a combination including nonce B.  This
attacker could replay the intercepted Binding Update message.

Furthermore, a MN may end up authenticating multiple Binding Update
messages with different sequence numbers, but with the same nonce B.  An
attacker could then intercept a Binding Update message with sequence
number X, while the CN would block a combination including sequence
number X+n.  Again, the attacker could replay the intercepted Binding
Update message.

A solution to this problem would be for the CN to keep *every*
combination of HoA, CoA, seqno, and nonce index for *each* nonce that is
currently valid.  The CN could then block each such combination for a
while when the MN de-registers.

Kind regards,
- Christian

-- 
Christian Vogt, Institute of Telematics, University of Karlsruhe
www.tm.uka.de/~chvogt/pubkey/

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6