Subject: RE: [mobile-ip] Security on Local "Home Agent" Functionality?

From: "Peter Grimstrup (TED)" <[email-masked]>
Date: Fri, 15 Mar 2002 08:32:42 +0100

Comment inline:

> -----Original Message-----
> From: James Kempf [mailto:[email-masked]]
> Sent: 15. marts 2002 00:16
> To: [email-masked]
> Subject: [mobile-ip] Security on Local "Home Agent" Functionality?
> 
> 
> I'm reading through Section 10.10 in the MIPv6 spec, and there is a
> description how to establish forwarding from previous care of 
> address by
> sending a BU to a "home agent on the previous link". In 
> Section 10.5, it
> describes how an AR advertises a global unicast address for use as a
> local "home agent." I'm wondering about the security implications of
> this.
> 
> One of the nice security aspects of IPv6 router discovery is that the
> hosts don't learn anything other than a link local address for the

Not correct any more:
A Home Agent reveals its own full address using the "Modified Prefix
Information Option" (6.2 in draft-15).
This is needed by other Home Agents to build the list of Home Agents
for the "Home Address Discovery" procedure.

	Peter
 
> routers. This helps prevent attackers from outside the local network
> hacking into routers. I would expect that a router might have a site
> local address for network management purposes, but a global 
> address? And
> is it such a good idea to expose that address to hosts? Do 
> people think
> this option will be widely deployed?
> 
> Also, given that it is deployed, what should the security requirements
> be on sending a BU to this local "home agent"? Should they be the same
> as for a CN, namely default RR and something stronger when we 
> figure out
> what? Or as for sending a BU to the home network home agent, namely
> based on an IPsec SA?
> 
> I haven't seen any discussion of this, so maybe it isn't particularly
> important, but it struck me as curious.
> 
>             jak
> 
>

---

From: "James Kempf" <[email-masked]>
Date: Fri, 15 Mar 2002 10:31:01 -0800

Peter,

> for the "Home Address Discovery" procedure.

I was speaking of IPv6 routers in general. A Home Agent is
a special IPv6 router, and I believe, if the BU security discussion
recommendations are followed, the host will have some kind
of strong, long lasting security association with it. Therefore, I don't
see
much problem in revealing a global address (it would be
necessary for the IPsec SA anyway, if I my understanding
of how IPsec policy is used in this case is correct).

However, the AR is in the foreign network. Revealing
a global address there is an entirely different matter.
Do we expect the MN to have an IPsec SA with
every AR in the foreign network that implements
on-link "home agent" functionality?

            jak