Subject: [Mip6] Other threats for DS-MIPv6

From: Alexandru Petrescu <[email-masked]>
Date: Mon, 27 Mar 2006 22:40:19 +0200

The draft on DS-MIPv6 has a nice little section on explaining how the
intrinsic security of IPv6 BU/BAck ESP/AH is security enough for DS-MIPv6.

While this may help against the IPv6 threats it doesn't protect against
any IPv4 threats.  IPv4 is used when the access network is exclusively
IPv4.  UDPv4 is used when the access network is v4 and behind NAT.

So I believe much expansion is needed for the Security Considerations
section.

Alex

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Alexandru Petrescu <[email-masked]>
Date: Tue, 28 Mar 2006 03:46:08 +0200

>> The draft on DS-MIPv6 has a nice little section on explaining how 
>> the intrinsic security of IPv6 BU/BAck ESP/AH is security enough 
>> for DS-MIPv6.
>> 
>> While this may help against the IPv6 threats it doesn't protect 
>> against any IPv4 threats.

As with MIPv6, there are some risks between two legitimate MNs of same
HA; but now they can use the NAT Detection procedure as an additional
weakness.

It's easy for an attacker MN to send UDPv4-encapsulated BU to HA with
IPv4 src containing its own IPv4 address; and the IPv6 CoA in BU as the
current legitimate MN's v4-mapped IPv6 CoA.  The HA will believe there
is a NAT in the way (there isn't) and re-direct all traffic for
legitimate MN's CoA to attacker MN's v4 "CoA", by means of UDPv4
encapsulation.  No?

Another threat relies on the weakness that HA isn't requested to have or
develop an SA with the NAT behind which MN is, and thus can't verify the
src address field of the packets coming from NATs.  An attacker MN, not
even sharing keys with HA, can easily send whatever BU with v4 HoA
option unspecified "0.0.0.0" and create DoS state at HA (because 0.0.0.0
means request of address assignment).  No?

Some IPv4 potential threats are described in the Security Considerations
section of rfc3519 for NAT traversal for MIPv4.  You think they don't
apply to DS-MIPv6?

Alex