Subject: [MBONED] draft-ietf-mboned-auto-multicast

From: Bill Atwood <[email-masked]>
Date: Wed, 12 Jan 2011 14:16:59 -0500

Hello,

My student and I are working on a project concerned with AMT, and he is
preparing a formal validation of the AMT message exchanges, using the
AVISPA tools.  The goal is to demonstrate the security of the AMT
exchanges.  We have a question about the security features of AMT, and
we hope that someone on the list will be able to respond to it.

In the latest IETF draft of "Automatic IP Multicast Without Explicit
Tunnels", version 10, under section 5.1.2 entitled "Spoofing
Considerations", the following is mentioned:

An attacker can "affect the group state in the relay or gateway by
spoofing the source address in the join or leave reports", where this
can lead to launching "reflection or denial of service attacks" on the
target. It is further stated that this can be mitigated by using a
"three way handshake between the gateway and the relay for each
multicast membership report or leave".

Given that the Gateway is going to send periodic AMT Membership Updates
in order to keep the state for (Sn,Gn) alive in the relay, how does
initiating the three-way handshake for each multicast membership report
or leave help in avoiding the attacks mentioned in the draft?

Any insight from the draft authors (or anyone else!) will be very much
appreciated.

  Bill Atwood
-- 

Dr. J.W. Atwood, Eng.             tel:   +1 (514) 848-2424 x3046
Distinguished Professor Emeritus  fax:   +1 (514) 848-2830
Department of Computer Science
   and Software Engineering
Concordia University EV 3.185     email: [email-masked]
1455 de Maisonneuve Blvd. West    http: //users.encs.concordia.ca/~bill
Montreal, Quebec Canada H3G 1M8

---

From: Thomas Morin <[email-masked]>
Date: Thu, 13 Jan 2011 09:49:40 +0100

Hi Bill,

> or leave help in avoiding the attacks mentioned in the draft?

The periodic Membership Updates are subject to the three-way-handshake 
as well, so they do not have to be seen as different from a security 
standpoint, than the first and last, non-periodic, Membership 
Updates.    (said differently, the "each report or leave" phrase 
includes the periodic reports)

-Thomas