Subject: [mobile-ip] Binding Update <--> bu3way

From: "Charles E. Perkins" <[email-masked]>
Date: Fri, 07 Dec 2001 14:30:14 -0800

Hello Erik,

As I understand it, one of Jeff Schiller's main objections to the
Mobile IPv6 specification for handling Binding Updates could be
expressed as follows:

   Even if the specification _mandates_ that Binding Updates must
   be authenticated, some vendors or operators will configure
   systems that ignore mandated protocol behavior unless we
   devise some method that makes it easy to do the right thing.

I think that some people (e.g., me) interpreted this to mean that a
lightweight key distribution protocol was required before Mobile IPv6
could become Proposed Standard.  However, I now understand that this
wasn't the intent.  Maybe we can satisfy the requirement by using
your recently proposed BU3WAY draft to enable processing for Binding
Updates whenever a suitable security association is not available.

This would work as follows:

- If the mobile node has a security assocation with the
  correspondent node, it sends an authenticated Binding Update
- Otherwise, if a key establishment protocol exists, the mobile
  node initiates key establishment
- Otherwise, the mobile node carries out the BU3WAY operations

When we get a good key distribution protocol, and I reckon we have
several viable candidates, then BU3WAY would likely be required less
often, as mobile endpoints have better tools for establishing the
required security associations for authenticated Binding Updates.

If this seems like a reasonable plan, then I would like to also
suggest that the BU3WAY message formats be changed so that the
authorization cookie information be located into suboptions so that
the format can remain compatible with existing Binding Updates.
It would be possible for the Binding Update format to remain the
same even if the authorization happened one way or the other
depending on suboptions.

The downside is that now the correspondent node would have to
implement more protocol.  I hope it's not too much additional
stuff.

Regards,
Charlie P.

PS. I hope this hasn't all been said before in previous messages.
    I am still in the process of catching up with things.

---

From: Erik Nordmark <[email-masked]>
Date: Sun, 9 Dec 2001 21:32:01 +0100 (CET)

> Updates whenever a suitable security association is not available.

Do you think the basic 3-way for every update would perform well enough?
Or do you think there would be a need to establish a binding security 
association? 

>   correspondent node, it sends an authenticated Binding Update

By this do you mean IPsec SA or something more vague?

> - Otherwise, the mobile node carries out the BU3WAY operations

I think this runs into "negotiate down" security threats. (I think it 
is draft-draft-aura-mipv6-bu-attacks-00.txt that talks about this.)
For example, if a CN wants to use a high security as possible
how can it prevent an attacker from forcing the use of the weak BU3WAY?

   Erik

---

From: "James Kempf" <[email-masked]>
Date: Sun, 9 Dec 2001 17:56:18 -0800

Erik,

> Do you think the basic 3-way for every update would perform well
enough?

If the 3 way update needs to be done for every handover, then off the
top of my head, I think the
answer is no. It would, however, be useful to go through some
calculations to check this
intuition.

> Or do you think there would be a need to establish a binding security

I think this would be preferable for a longer lasting traffic pattern.

            jak

---

From: Charlie Perkins <[email-masked]>
Date: Mon, 10 Dec 2001 10:13:06 -0800

Hello Erik,

> Or do you think there would be a need to establish a binding security

I think that in many situations it would be better to have a binding
security association established.

> By this do you mean IPsec SA or something more vague?

I meant "binding security association", analogous to "mobility
security association" in IPv4.

> how can it prevent an attacker from forcing the use of the weak BU3WAY?

If the correspondent node wants higher security, it doesn't have to
respond to bu3way protocol efforts, right?  If you meant something
else, then maybe I have to look at the draft you cite.

Regards,
Charlie P.

---

From: Michael Thomas <[email-masked]>
Date: Mon, 10 Dec 2001 12:50:55 -0800 (PST)

> calculations to check this

   Something that needs to be kept in mind here is that
   MN/CN updates are probably a long-haul operation. That
   is, if you are in any way dependent to their timeliness,
   to support the needed performance characteristics, you're
   probably already in trouble because they may need to go
   half way around the world. 

   In this light, it may be that in combination with local
   convergence techniques -- FMIP, etc -- you can take the
   MN/CN binding update out of the critical handoff path in
   which case the performance of _any_ of these proposals
   is moot (handoffwise, that is).

		Mike

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 10 Dec 2001 23:36:01 +0100 (CET)

> security association established.

OK.  Good to know.

> else, then maybe I have to look at the draft you cite.

Yes, but it seems like the MN should be able to influence which security
is required to accept its BU instead of only making it up to the CN.

For instance imagine a MN that only wants to use the more secure method
talking to a CN that supports both methods (it supports the weaker method
for interoperability with MNs that use the weaker one).
Then the MN can use the stronger method with that CN, but an
attacker can attack using the weaker method.

  Erik

---

From: Charlie Perkins <[email-masked]>
Date: Mon, 10 Dec 2001 14:49:55 -0800

Hello Erik,

> attacker can attack using the weaker method.

Maybe it would be a good idea to require that Binding Updates be
authenticated with pre-established security associations whenever
possible.  If a malicious node attempts bu3way when the correspondent
node already has a better security association established, then that might
be deemed an error by the correspondent node.

I know this isn't a complete solution, but at least it's a start.  The
details would depend on the final form of any key establishment
protocol, probably.

Regards,
Charlie P.

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 11 Dec 2001 00:20:47 +0100 (CET)

> details would depend on the final form of any key establishment

I don't think that is needed - picking a single method for securing BUs
is probably the best (assuming the chairs can get concensus around that).

BTW: You seem to have gone full circle back to requiring a PKI - or how would
the pre-established SA be created?

  Erik

---

From: Charlie Perkins <[email-masked]>
Date: Mon, 10 Dec 2001 15:30:11 -0800

Hello Erik,

> the pre-established SA be created?

I didn't say anything about how the security association was to
be created.  If I don't know this, does it mean I require PKI?

I myself like the idea of solving one piece of the puzzle at a time,
instead of having to do everything all at once.  So, I would much
prefer it if we could figure out how to do security associations later.
There's already good ways known about how to authenticate
Binding Updates, once the security association is in place, which
could potentially be done in any of several ways.  I think it would
be a mistake to require a one-size fits all method for establishing
the necessary security associations at the mobile node.

Regards,
Charlie P.