Subject: [mobile-ip] MIPv6 SecReqs: HA Option processing, HA Dyn Discovery

From: Pekka Savola <[email-masked]>
Date: Sun, 30 Sep 2001 15:49:31 +0300 (EEST)

Hello all,

(please keep Cc:, not on the list)

About draft-ietf-mobileip-mipv6-scrty-reqts-00.txt ...

First a gripe about Mobile IPv6...

It appears to me that MIPv6 has gotten awfully "fat" with all of these
options, and may not be globally, securely workable in the end.  Would it
be better to consider simpler scenarios at first, e.g.

 1) MN's would send BU's to CN's first-hop routers (e.g. subnet-router
anycast address); this might scale better especially if IPv6 end-nodes are
supposed to be simple.

Does anyone really believe that a washing machine, connected to an
Intranet using IPv6, MUST be able to process e.g. Home Address Destination
option, or SHOULD be able to process Binding Updates?, or

 2) Reinstate FA's (e.g. by default all IPv6 routers that implement MIPv6)
in the picture, or

 3) Never mind route optimization, always tunnel back to HA

Now to the security requirements draft...

I have may have missed something, but it appears to me that two scenarios
discussed in more detail:

 1) usage of Home Address Option.  Its use need not be authenticated.
Anyone can put it in.  This makes _one-way_ (nice enough for UDP and ICMP)
IP spoofing less than trivial.

One possible fix (needs more analysis):

Home Address option would be processed only if either of these apply:
 - the packet, including Home Address option, is authenticated, or
 - in CN, there exists a Binding between the CoA and Home Address in the
packet (and the Binding was created securely)

caveat here is, of course, that when establishing TCP sessions with CN, if
you can't use Home Address option, the connection is very likely to break
if MN moves...

... but nonetheless, I consider the security to be far more important than
unbroken mobility ...

As can probably be read from above, I consider adding too much required
complexity to _every_ IPv6 node a very bad thing.

 2) the assumption may be flawed in a scenario:

   1  The mobile node and the HA have setup a pre-established security
      association before the mobile node begins to roam and connects to
      the network from a location that is not its home.

This wouldn't appear to work with e.g. 'Dynamic Home Agent Address
Discovery' (10.8), that is, e.g. when the trusted HA dies and MN is away
from home and it needs to find the new HA.  The assumption is valid only
after a HA-MN relationship has been formed.

btw,

   [Ref2]    draft-nikander-ipng-address-ownership-00.txt - Work in
             progress

-01 is the latest in IETF repositories, and even that has been replaced
with the "removed" message.  I don't think it's appropriate to refer to
a draft like this :-)

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords