Subject: RE: [mobile-ip] A threat RR doesn't solve and that doesn't seem t o exist in IPv4

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Mon, 7 Jan 2002 15:26:25 +0100

Pekka, 

  > On the question of whether RR alone could provide security
  > that is in par with IPv4 security, I think I have came up
  > with an attack scenario that RR alone does not block (see
  > below).  

=> Yes I think we're talking about the same attack.
But I'm not sure about your assumption of the BSA.

However, this attack is certainly fairly far fetched,
  > and I _personally_ could imagine that being vulnerable to
  > this one _might_ be acceptable.

=> I don't know what the odds are, but IMO the entire
security discussion should be held on a certain level
of abstraction that allows the chosen mechanism to 
survive unexpected and future scenarios.

  > The attack scenario:
  > 
  > Let us consider an attacker A, a corrensponding node CN, and
  > a pre-selected mobile node MN whose home address is HoA.
  > Now, A has decided to steal all traffic that CN will
  > initiate towards MN.  To do so, it somehow arranges itself
  > _once_ to the path between CN and MN's HA.  It may do this,
  > for example, by visiting the network where CN is located,
  > where MN's HA is located, or any network in between.

=> Yes

  > 
  > While being at the path between CN and MN's HA, the attacker
  > creates a binding (and a corresponding BSA) at CN.  This will
  > succeed, since A knows MN's home address and it can foil the
  > RR test.  As a result, CN believes that MN is currently located
  > at the adddress given by A, and therefor whenever it sends
  > packets to MN, it will send them to the attacker.  Thus, A
  > is able to steal all connections initiated by CN towards MN.
  > Furthermore, if CN does not check the return routability
  > of the MN's home address if there is already an existing BSA,
  > then the attacker can keep up the faulty binding as long as it
  > wishes, simply by renewing the binding and BSA periodically.
  > To renew, it no longer needs to be at the path between the CN
  > and the MN's HA.

=> This is where I'm not sure we agree. I think if we do
RR, we most definitely would not want to have a BSA. 
The reason: Exactly this scenario you mention. 
Actually, I'm not sure if Erik and Mike intentionally
did so in their proposals, but that was my assumption.

I agree with the intial part of the attack, but I don't
think the BSA should be formed and hence the attack
is only limited to the time where the atacker is 
still on the CN-HA path. 

Cheers,
Hesham

---

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 29 Jan 2002 16:13:09 +0100

>
  > 
  > I wonder why "packet size" is not taken into consideration. 
  > In a radio
  > network packet transmission is the most power consuming thing and
  > power consumption linearly increases with packet size.
  > 
  > So, if a key establishment extension contains lots of 
  > cryptographic data,
  > this will:
  > 
  > 1. Increase power consumption on hosts,
  > 2. Increase packet loss rate, hence the actual number of 
  > packets exchanged
  > (and, consume more power).
  > 
  > I'm too pessimistic?

=> No. But maybe one thing to consider is that if we have
cryptographic data, then we can establish a BSA.
So the MN doesn't need to re-send a number of 
messages every time it moves. Instead only one
BU. 
If this is not an issue and the MN will not move
very often, then reducing cryptographic data 
might have some advantages for power saving. 

Hesham

  > REgards,
  > pars