Subject: [Mipshop] FMIPv6: Security Considerations

From: Rajeev Koodli <[email-masked]>
Date: Tue, 30 Sep 2003 14:37:52 -0700

Hello folks,

the new mipshop charter suggests documenting the
security issues related to FMIPv6. Could folks take a
look at the Security Considerations section in version 07
and suggest text if necessary ?

The following issues are addressed in the draft.
Note that we are not trying to solve these issues; we are only
documenting them.

a) insecure FBU: any host can steal traffic and/or redirect
    traffic to an unsuspecting node. Identical to MN - HA
    consideration
b) secure FBU, malicious or inadvertant traffic re-directon:
     traffic can be re-directed to _some_ NCoA.

MN - AR SA is key for a). How it is established is not
addressed in the current FMIPv6 effort.

For b), HI and FNA are crucial. NAR must be able to verify,
perhaps through a security database lookup, if the NCoA is
in use. If so, dropping FBU and requiring the MN to
re-configure (or provide an alternative address) is necessary.
If the MN continues to use NCoA, what is the recourse ? What
recommendations exist today ?

Are there other issues ?

Regards,

-Rajeev

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop