Subject: Re: [MEXT] [RFC3775 changes] Use of DHAAD mechanism?

From: "Jean-Michel Combes" <[email-masked]>
Date: Thu, 10 Jan 2008 19:44:55 +0100

Hi,

2007/12/28, Jean-Michel Combes <[email-masked]>:
> Hi George,
>
> 2007/12/18, George Tsirtsis <[email-masked]>:
> > Another thing to do maybe would be to add text to the security section
> > indicating what the security issues with DHAAD might be.
>
> Good idea :)
> I will submit some text when I will come back from vacations.
>

as promised, here is the text I suggest to add to the security section:

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Section, sub-section and paragraph involved: 15.5

OLD TEXT:
15.5.  Dynamic Home Agent Address Discovery

   The dynamic home agent address discovery function could be used to
   learn the addresses of home agents in the home network.

   The ability to learn addresses of nodes may be useful to attackers
   because brute-force scanning of the address space is not practical
   with IPv6.  Thus, they could benefit from any means which make
   mapping the networks easier.  For example, if a security threat
   targeted at routers or even home agents is discovered, having a
   simple ICMP mechanism to easily find out possible targets may prove
   to be an additional (though minor) security risk.

   Apart from discovering the address(es) of home agents, attackers will
   not be able to learn much from this information, and mobile nodes
   cannot be tricked into using wrong home agents, as all other
   communication with the home agents is secure.

NEW TEXT:
15.5.  Dynamic Home Agent Address Discovery

   The dynamic home agent address discovery function could be used to
   learn the addresses of home agents in the home network.

   The ability to learn addresses of nodes may be useful to attackers
   because brute-force scanning of the address space is not practical
   with IPv6.  Thus, they could benefit from any means which make
   mapping the networks easier.  For example, if a security threat
   targeted at routers or even home agents is discovered, having a
   simple ICMP mechanism to easily find out possible targets may prove
   to be an additional (though minor) security risk.

   Furthermore, it is impossible to authenticate a DHAAD request: the
HA doesn't know who is behind the CoA used as source address in the
request and the destination address is an anycast type address,
forbidding the use of IKE/IPsec.

   At last, it is important to remember that the DHAAD mechanism is
ICMP based and that many ISPs are blocking such type of messages
today.

   Apart from discovering the address(es) of home agents, attackers will
   not be able to learn much from this information, and mobile nodes
   cannot be tricked into using wrong home agents, as all other
   communication with the home agents is secure.

   Nevertheless, it is strongly recommended to use the mechanisms
specified in [Boot-Integrated] and [Boot-Split] instead of the DHAAD
mechanism.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Section, sub-section and paragraph involved: 18.2

OLD TEXT:
....

NEW TEXT (to add):

[Boot-Integrated]
Chowdhury, K. and A. Yegin, "MIP6-bootstrapping for the Integrated
Scenario", draft-ietf-mip6-bootstrapping-integrated-dhc-05 (work in
progress), July 2007.
[Boot-Split]
Giaretta et. al., "Mobile IPv6 bootstrapping in split scenario.", RFC
5026, October 2007.

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Comments are welcome :)

Best regards.

JMC.

_______________________________________________
MEXT mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mext