Subject: [MEXT] Issue #2: Recommendation for closure on on "Use of DHAAD mechanism"

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 27 Jun 2008 13:22:19 -0700

Hello folks,

After 80,000 messages, discussion about the DHAAD
discovery message suddenly stopped when, it seemed
to me, a resolution was nearly at hand.  After reading
through the "harmful" ID that was submitted, I imported
a bit of text for another try at a resolution to be used in
rfc3775bis.  Here is the resulting modification to
Julien's previous effort.

------------------------------------------------------------------------
OLD:

15.5.  Dynamic Home Agent Address Discovery

   The dynamic home agent address discovery function could be used to
   learn the addresses of home agents in the home network.

   The ability to learn addresses of nodes may be useful to attackers
   because brute-force scanning of the address space is not practical
   with IPv6.  Thus, they could benefit from any means which make
   mapping the networks easier.  For example, if a security threat
   targeted at routers or even home agents is discovered, having a
   simple ICMP mechanism to easily find out possible targets may prove
   to be an additional (though minor) security risk.

   Apart from discovering the address(es) of home agents, attackers will
   not be able to learn much from this information, and mobile nodes
   cannot be tricked into using wrong home agents, as all other
   communication with the home agents is secure.

NEW:

15.5.  Dynamic Home Agent Address Discovery

   The dynamic home agent address discovery function could be used to
   learn the addresses of home agents in the home network.

   The ability to learn addresses of nodes may be useful to attackers
   because brute-force scanning of the address space is not practical
   with IPv6.  Thus, they could benefit from any means which make
   mapping the networks easier.  For example, if a security threat
   targeted at routers or even home agents is discovered, having a
   simple ICMP mechanism to easily find out possible targets may prove
   to be an additional (though minor) security risk.

*  This document does not define any authentication mechanism for
*  dynamic home agent address discovery messages. Therefore the home
*  agent cannot verify the home address of the mobile node that
*  requested the list of home agents.

   Apart from discovering the address(es) of home agents, attackers will
   not be able to learn much from this information, and mobile nodes
   cannot be tricked into using wrong home agents, as all other
   communication with the home agents is secure.

*  In cases where additional security is needed, one may consider
*  instead the use of MIPv6 bootstrapping [RFC5026] (based on
*  DNS SRV Resource Records [RFC2782]) in conjunction with security
*  mechanisms suggested in these specifications.  In that solution,
*  security is provided by the DNSSEC [RFC4033] framework.  The needed
*  pre-configured data on the mobile node for this mechanism is the
*  domain name of the mobile service provider, which is marginally better
*  than the home subnet prefix.  For the security, a trust anchor which
*  dominates the domain is needed.
*
*  Finally, it should be noted that the specification of ICMP to carry
*  DHAAD incurs a certain deployability risk related to the perceived
*  insecurity of ICMP messages.  Many ISPs are blocking ICMP on all links
*  except the first hop, because ICMP is known to be a vehicle for DoS
*  attacks and other sorts of threats.

------------------------------------------------------------------------

Regards,
Charlie P.

_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext

---

From: [email-masked] (Arnaud Ebalard)
Date: Sat, 28 Jun 2008 14:21:14 +0200

Hi,

> Julien's previous effort.

simple and explicit. good.

> *  dominates the domain is needed.

I don't have an opinion on that block.

> *  attacks and other sorts of threats.

IMHO, this should go.

Most of the ISP I know do not filter ICMPv6 which do not target their
routers and based on tests I performed, they can flow without problem on
the IPv6 internet. Can you point an ISP that implement what you
describe? Does it specifically filter some type/code?

The ability to mount DoS attacks with ICMPv6 messages is very limited,
IMHO, compared to TCP SYN packets, UDP packets against specific upper
layer protocols and possibly some IPv6 extension headers.

Cheers,

a+

---

From: "Vijay Devarapalli" <[email-masked]>
Date: Mon, 30 Jun 2008 20:39:21 -0400

> > *  attacks and other sorts of threats.

I agree, but for a different reason though. If ICMP is blocked, isn't it
obvious that DHAAD messages can't make it through?

Viujay