Subject: RE: [nemo] Implemetor's comments on RFC3963

From: "Pascal Thubert \(pthubert\)" <[email-masked]>
Date: Tue, 8 Nov 2005 15:15:37 +0100

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf Of
Simon Oosthoek
>Sent: Tuesday, November 08, 2005 9:14 AM
>To: [email-masked]
>Subject: Re: [nemo] Implemetor's comments on RFC3963
>
>Alexandru Petrescu wrote:
>>>>>>>The detail explanation of how the search in the Prefix Table
>>>>>>>could help too, especially since we count on the Prefix Table
>>>>>>>as a security measure. -would HA check the HoA for every
>>>>>>>entry's HoA field and then match  the MNP in the BU against
>>>>>>>that entry's MNP field? -or would it first check the MNP and
>>>>>>>then the HoA? -what's a successfull check.
>>>>
>>>>It is indeed implementation-specific.  It should however clarify
>>>>_why_ this check is done and the kind of attack it protects
>>>>against.  The text could say: "this Prefix Table verification helps
>>>>protect against an attack where an attacker MR sends BUs with the
>>>>legitimate MR's MNP, both MRs being managed by same HA".
>>>
>>>
>>>we have some text in section 6.1.2
>>>
>>>The Home Agent SHOULD be able to prevent a Mobile Router from
>>>claiming Mobile Network Prefixes belonging to another Mobile Router.
>>>The Home Agent can prevent such attacks if it maintains a Prefix
>>>Table and verifies the prefix information provided by the Mobile
>>>Router against Prefix Table entries.
>>>
>>>isnt this sufficient?
>>
>>
>> Sorry - I agree!  For some reason that text wasn't immediately handy
to
>> me.  That was exactly the text I was looking for.
>>
>> If both of you guys think that that text is enough, and that an
example
>> check is not necessary (check the MNP of BU to MNP in the prefix
table,
>> exact match with prefix length) then I won't fight for it.
>
>Just out of interest, how would you verify this table? I'm sure this
>would need some form of crypto verification to make sure the MR isn't
an
>imposter, right?
>
>(I'm looking at NEMO as a solution for secure personal networks, so
from
>my perspective, authentication and authorisation is very important)
>
>Cheers
>
[<PT>] Just to give you an example, there might be a crypto relationship
between the Home Address and the last bits in the MNP.

Pascal