Subject: RE: [NSIS] Req-Draft: Open Issue 2: Independence of reservation i dentifier

From: "Hancock, Robert" <[email-masked]>
Date: Mon, 4 Nov 2002 20:24:09 -0000

Bob,

>   *> (b) especially given that supporting such an identifier is hard.
>   *> 
> 
> I am puzzled about what is hard about it.  It seems pretty 
> straightforward.
> Is there a one or two-sentence explanation of why it is hard?
> 
> Bob

This is alluded to in the framework draft (5.3.1/5.3.2, also 4.5.2).

The hard point is the security aspect, since so far as I can tell, (in general) any random node in the Internet could pop up and say "I want to modify reservation XXX 'cos it's really mine", and it would be hard to decide whether it wasn't just the real node having moved. All it has to do is get it's signalling message to intersect the existing path for that reservation id. 

(I can also imagine identifier scoping issues needing careful analysis).

There's an interesting proposal in draft-westphal-nsis-qos-mobileip-00.txt, but it requires a fair amount of public-key-like activity per message. By 'hard' I mean 'not impossible, but not easy'. It may be that a sufficiently careful threat analysis would prove the security problems were illusory, but no-one has done that yet. 

Cheers,

Robert

PS I'm aware that widespread consensus !==> truth. However, I'm working on the assumption that we can proceed on the basis of consensus rather than proven truth, else progress is liable to be slow ;-).
_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: "Hannes Tschofenig" <[email-masked]>
Date: Tue, 5 Nov 2002 09:39:17 +0100

hi robert.

i guess we can say that we looked at the security issues of the
reservation/session identifier. this issue was mentioned already long time
ago and is included in the nsis requirements doc and in the nsis threats
document. since i never got any comment to it i would ask people to tell me
their opinion.

ciao
hannes

> The hard point is the security aspect, since so far as I can
> tell, (in general) any random node in the Internet could pop up
> and say "I want to modify reservation XXX 'cos it's really mine",
> and it would be hard to decide whether it wasn't just the real
> node having moved. All it has to do is get it's signalling
> message to intersect the existing path for that reservation id.
>
> There's an interesting proposal in
> draft-westphal-nsis-qos-mobileip-00.txt, but it requires a fair
> amount of public-key-like activity per message. By 'hard' I mean
> 'not impossible, but not easy'. It may be that a sufficiently
> careful threat analysis would prove the security problems were
> illusory, but no-one has done that yet.
>
> Cheers,
>
> Robert
>
> PS I'm aware that widespread consensus !==> truth. However, I'm
> working on the assumption that we can proceed on the basis of
> consensus rather than proven truth, else progress is liable to be
> slow ;-).