Subject: RE: [mobile-ip] Security on Local "Home Agent" Functionality?

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Fri, 15 Mar 2002 23:28:31 +0100

James,

  > global as
  > > well as site-local addresses of the router to the nodes 
  > on the link.
  > >
  > > I don't think security of the routers should depend on 
  > their global
  > addresses
  > > being 'secret'. Traceroute would presumably return them 
  > in any case.
  > >
  > 
  > OK. But I assume traceroute would show a site local or link local
  > address if the router only had that, right? So an attacker 
  > wouldn't be
  > able to hack into it even if they knew it was there, unless 
  > they could
  > break through the site local address routing. And I agree 
  > that keeping
  > the router's address "secret" is not sufficient for 
  > security, but it is
  > like making the TTL 255 on ND traffic, a quick and easy way 
  > to eliminate
  > one class of problems, don't you think?

=> Even if you only have site-local, you
can be attacked from within the site. 
Some routers will need global addresses anyway
if the network management nodes are not 
in the same site.

  > 
  > > The benefits of creating a binding for a previous CoA is 
  > a function of
  > > the time it takes to do this update - the goal is to 
  > prevent packets
  > that
  > > are in transit from CNs (and perhaps MN) from being dropped on the
  > previous
  > > link. Perhaps this is better done using other local mechanisms to
  > minimize
  > > packet drops during handoff?
  > >
  > 
  > Actually, I think so. This is precisely what the fast 
  > handoff proposals
  > do. The problem with forwarding from previous care of 
  > address is that it
  > is reactive and requires the MN to have a care of address. 
  > By the time
  > the MN has obtained a care of address, many packets may have been
  > dropped 

=> Not if you get the CoA before you move.

(note that other reactive proposals not requiring the MN to
  > obtain a care of address may not have this problem). The proactive
  > approaches in the FMIPv6 draft do better, because they 
  > allow the tunnel
  > to be set up as soon as the MN moves from the old AR.

=> But all methods in FMIPv6 will do that. Some 
with explicit L3 signalling and some without. 
The question that comes to mind is: 
If there are security problems with explicit 
L3 signalling, does removing this signalling and
replacing it by inter-router signalling 
remove the problems ? ;) 
I mean, if the required security level for a node
to forward traffic to an address is to prove
that it has the authority for doing so (hence RR), 
can we just assume that any router sending 
this message to another router, will have 
such authority ? 
I'm just not so sure that the FMIPv6 problems
will go away if we remove the BU signalling
to the default router. 

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Fri, 15 Mar 2002 15:00:14 -0800

Hi Hesham,

> if the network management nodes are not 

OK, but by not exposing the address to end
hosts, you decrease the chances. Also, if
the router needs to be managed from outside
the site, it could be done through a firewall-style
proxy. I'm not saying that site-local addresses
are the final answer to router security, just
that they strike me as a good idea, as does
not exposing the addresses to end hosts.

> => Not if you get the CoA before you move.

I was speaking in this email about FFPCA as described in
the FMIPv6 draft, not as augmented by FMIPv6. 

> will go away if we remove the BU signalling

Well, with regard to FMIPv6,
my thinking here is that any time you can convert
two problems into one generic problem
and just solve the generic problem, you win. :-)

Thus, if we could figure out some way to make
the FMIPv6 signaling:

    router<->router
    host<->local link router,

then we could remove the problem of how to secure
off-link router<->host and be left only with
the problem of how to secure host<->local link router.
This is a generic IPv6 ND problem, as we have
been discussing in the IPNG list, and so a solution
for ND would work for FMIPv6 also. Just like
MIPv6 uses standard ND signaling for CoA
aquistion, instead of special signaling as in MIPv4.

The router<->router security is presumably taken
care of by the backbone routing.

Maybe the host<->local link router security
solution would also work for the host<->off-link router
solution too, of course, but it strikes me as a worthwhile
effort to try to simplify the security problems associated
with fast handover in MIPv6 if we possibly can.

Make sense?

            jak