Subject: RE: [Mipshop] Possible Solution to Duplicate Problem?

From: "Soliman, Hesham" <[email-masked]>
Date: Thu, 25 Aug 2005 23:00:29 -0400

Many security mechanisms have documented and known attacks that
are considered acceptable. In order to carry out this attack,
the attacker needs to know:
- Future address of the MN
- Possibly, when the MN is going to do a handover. 

Given this, there is one more question:

 > An event which, in the natural order of things, is 
 > relatively improbabile 
 > can become very likely in the face of malicious human intent.
 > 
 > Not checking for duplicates opens a specific attack in which 
 > the attacker 
 > can intercept some part of a victim MN's traffic prior to 
 > movement if 
 > handover is predictive. The attacker establishes a duplicate 
 > nCoA on NAR 
 > prior to the victim MN's movement, then when the PAR starts 
 > sending buffered 
 > traffic, the attacker gets the traffic rather than the 
 > victim. At a minimum, 
 > the attacker can disrupt the MN's traffic. The attack is 
 > particularly 
 > troublesome because it happens on a link where the MN isn't 
 > currently 
 > (though it will be shortly). The probability of the attacker 
 > being able to 
 > deduce the victim's future address is reduced if the MN uses 
 > SEND or RFC 
 > 3041 addresses, 

=> "Reduced" is an understatement IMO. What is the probability
of knowing the address? What can the attacker do with this 
information?
I'd be happy to discuss this if you can tell us that there is 
a significant probability of this happening.

   but it can't be guaranteed that this will 
 > always be the 
 > case, since many MN's will likely use RFC 3513 addresses. 

=> How do you know that?? FMIP can easily require MNs to do whatever
deemed necessary, provided that the attack above is significant.
Please read the Node requirements doc, where it is clear that
the default is stateless address config.

Hesham

 > The attack can be 
 > eliminated entirely by using DHCP-assigned addresses, but as 
 > we've been 
 > discussing, it is not at all clear at this point how to 
 > cleanly integrate 
 > DHCP and FMIP.
 > 
 >             jak
 > 
 > 
 > 
 > 

===========================================================
This email may contain confidential and privileged material for the sole use
 of the intended recipient.  Any review or distribution by others is strictly
 prohibited.  If you are not the intended recipient please contact the sender
 and delete all copies.
===========================================================

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "James Kempf" <[email-masked]>
Date: Fri, 26 Aug 2005 10:04:32 -0700

>a significant probability of this happening.

Well, I don't like making extreme statements. :-) But, yes, using 3041 
addresses or CGAs will effectively eliminate this attack, if the host 
implementation is properly done. However, if the host reuses its randomly 
generated interface identifier when it moves to a new subnet, then 3041 
addresses won't provide much help (CGAs will, of course). The security 
considerations section in the FMIP document should say something about this 
topic, or possibly even in 3775bis (when we get around to doing it).

>the default is stateless address config.

So how is an FMIP router going to ensure that an MN uses CGAs or 3041 
addresses? As you say, the Node requirements document defaults to stateless 
address configuration, which means that the node is in control of how the 
address is generated.

            jak