Subject: [mobile-ip] Avoiding negotiate down hazards for BU

From: Erik Nordmark <[email-masked]>
Date: Sun, 9 Dec 2001 00:50:26 +0100 (CET)

Section 6.2 of draft-aura-mipv6-bu-attacks-00.txt
talks about the difficulty of allowing multiple methods for
securing BUs with different strength - that an attacker could always force
the use of the weakest method unless the negotiation of method
is done at the highest security. This is true in general.

However, if it turns out that the WG would like to pursue both a
method relying on just return routability and another method (like CAM/SUCV)
relying on a hash of a public key in the Interface ID part of the address,
then I think we can do better if there is a need.

The idea is to carve out half of the local INterface ID space (currently used
by RFC 3041 and other addresses) to mean "only accept BUs for this address
using the stronger method", with the weaker method (unless overridden by
local policy on the CN) is acceptable for all other Interface IDs. 
If course, this would mean revising at least RFC 3041.
But it might be an option if there is WG interest to pursue both classes of
methods.

  Erik