Subject: Re: [mobile-ip] Security on Local "Home Agent" Functionality?

From: Erik Nordmark <[email-masked]>
Date: Sun, 17 Mar 2002 02:12:03 +0100 (CET)

> OK. But I assume traceroute would show a site local or link local
> address if the router only had that, right? So an attacker wouldn't be
> able to hack into it even if they knew it was there, unless they could
> break through the site local address routing. And I agree that keeping
> the router's address "secret" is not sufficient for security, but it is
> like making the TTL 255 on ND traffic, a quick and easy way to eliminate
> one class of problems, don't you think?

Yes, traceroute will show whatever address the routers picks for the 
ICMP error. But it is harder to make sense out of traceroute if these
addresses can't be convered to hostnames that carry some information.

So having the router not have a global address makes a lot of assumptions
about the operational aspects of the network.

If we want the MIPv6 specification and MNs implemented from it
be able to do bindings for a previous CoA when the previous default router
doesn't have a global address it seems like there has to be a way to
tell whether the site-local address of that router is in fact valid
in the new location of the MN after a move.

> Actually, I think so. This is precisely what the fast handoff proposals
> do. The problem with forwarding from previous care of address is that it
> is reactive and requires the MN to have a care of address. By the time
> the MN has obtained a care of address, many packets may have been
> dropped (note that other reactive proposals not requiring the MN to
> obtain a care of address may not have this problem). The proactive
> approaches in the FMIPv6 draft do better, because they allow the tunnel
> to be set up as soon as the MN moves from the old AR.

OK

> > The security requirements for the HA result in the assumption that the
> MN
> > has a pre-configured arrangement with its HA in order to associate
> > the authorization to do bindings for the HoA with an IPsec SA.
> > If this is applied to the HA for the previous CoA it would seem to
> > require some form of pre-establishment there as well.
> > But that wouldn't introduce any new security concerns and not require
> > additional specification work.
> >
> 
> But shouldn't this at least be stated in the MIPv6 spec somewhere?

Yes, I think so.

   Erik

---

From: "James Kempf" <[email-masked]>
Date: Sun, 17 Mar 2002 21:32:59 -0800

> about the operational aspects of the network.

True.

> in the new location of the MN after a move.

Well, one of the points I think I am trying to make is that FMIPv6 is
probably going to be better for fast handover, though there are other
reasons why one might want to do FPCoA. And if it were possible in
FMIPv6 to confine signaling between the mobile host and the local access
router, the mobile host would never need to discover a global or site
local address, it could always just use the on link address. This might
be able to reduce the security impact on FMIPv6 considerably.

            jak