Subject: [mobile-ip] question on NAT traversal for MIP draft (v 01.txt)

From: "Alpesh S. Patel" <[email-masked]>
Date: Sat, 23 Mar 2002 06:50:27 -0800

Hi,

For the NAT Traversal for MIP draft, I am concerned about section
4.5 Foreign Agent Considerations

The last paragraph on page 16 indicates that FA may add the UDP Tunnel
request extension even when FHAE is not present. I am not comfortable
with this statement. It should be added only if FHAE is present or else
it
is a security hole - a third party can append this extension before RRQ
is
fowarded to HA.

On the other hand, I agree that this makes it difficult to scale as it
introduces
the classic key distribution problem.

Was this deliberate or overlooked. Can someone educate me on it.
thx
-a

---

From: "Henrik Levkowetz" <[email-masked]>
Date: Mon, 25 Mar 2002 09:47:14 +0100

Alpesh,

	Let us consider what a man-in-the-middle could accomplish by
adding this extension?

	If he adds this extension, and changes the source address, then 
the HA will use UDP encapsulation, when it otherwise would not. The
UDP encapsulated traffic will go to a wrong destination. This does
not differ in any essential manner from changing the source address
of a registration request without this extension.

	If the source address is not changed, the HA won't use UDP, except
if the extension uses the Force bit. In this case, a reply will come
back with a UDP Tunnelling extension. a)If the FA understands this, it
will do de-tunnelling, and the traffic will flow normally, or it may
have UDP tunnelling disabled, in which case it will not accept the
reg. reply. b) If the FA does not understand this, it will reject the
registration reply because it contains an extension it does not 
understand in the 0 to 127 range.

	So it seems to me that the extent of the attack is to force the
use of UDP tunnelling where it is not needed, or to have the registration
rejected. The latter can be done in easier ways.

	If this is the extent of the attack possible, I don't think
it warrants requireing that this particular extension only be used
with a Foreign-Home Authenticaiton-enabling Extension present. We might
add text to indicate that FA's should only accept registration replies
with UDP Tunnel extensions after the Mobile-Home Auth. Ext. when they 
are behind a NAT (and thus are advertising with the U bit set).

	Have I missed something?

	Best,
		Henrik