Subject: RE: [mobile-ip] CLARIFICATION: Unverified HAO Processing - Recommendation note

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Fri, 8 Mar 2002 02:42:30 +0100

Jari,

  >   - Injecting packets to unsecured payload traffic by sending
  >     spoofed packets along a legal stream really is possible
  >     even without mobility. One just spoofs CN address inserting
  >     it to source address and adds those to the legal stream if on
  >     path. 

=> Isn't 'on path' the keyword here ? 
Ignoring on path attackers (because you said
they already exist), doesn't the inability 
of CNs to place filters allow for off-path
attackers? I thought this was the main
issue here, but I admit I haven't read every
mail on this thread. 

Hesham

Exact tagging is actually addressing the case when
  >     tagging should also consider that application data traffic
  >     is unsecured. Tagging can hardly fix that, and given the
  >     source IP can be spoofed without mobility, the comparison
  >     in the discussion so far has not been completely fair.
  >     The definition of do-no-harm is not clear from the discussion
  >     thread. I still suspect tagging does not go beyond this
  >     when comparing to this non-mobility case.
  > 
  >   - What a filtering firewall really does is to also block the
  >     legal CN in the above non-MIPv6 case. If tagging is
  >     there, any packet prompting filtering on the CN-HA path
  >     can then cause blocking of all packets going to the
  >     destination HoA. Useful packets are lost but so are in
  >     the above case. There are only differences in nuances,
  >     now the attacker does not have to change source address
  >     and a filter has a different but equally stateless rule
  >     that instead of the source address filters by the
  >     destination address, while the tag gives the traceability.
  >     One could claim there is a difference in the added ability to
  >     do off path attacks with tagging but unless we have globally
  >     deployed martian filtering (which we do not have), one
  >     can also mount the above type of source spoofing attacks with
  >     non-mobility packets even from off-path locations.
  > 
  >   As a conclusion, I can live with the HOA tagging being an
  >   option with a separate specification added later on, to
  >   expedite the base specification, but do not yet understand
  >   the security arguments against tagging.
  > 
  > BR,
  > 
  > -Jari
  >

---

From: "Jari T. Malinen" <[email-masked]>
Date: Thu, 07 Mar 2002 23:20:52 -0800

> issue here, but I admit I haven't read every

Actually, CN having filters by the tagging schemes
would be quite feasible, but the reordering of packets
vs tags makes precise filtering (filter exactly attacker
packets only) harder on other nodes between
CN and HA. I was questioning is this different from
a non-mobility case with spoofed CN address in attacker's
packet.

And also, questioning the more harm argument,
comparing to non-mobility case, there could be similar
off-path attacks (attacker just inserting an arbitrary
spoofed address to IPhdr source) if/since there can be
places/paths where we do not have Martian filtering
(ingress filtering from addresses coming from
topologically "wrong" directions) verifiably on
every path an attacker could use.

BR,

-Jari