Subject: [mobile-ip] Is RR only enough ?

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Thu, 3 Jan 2002 15:29:52 +0100

=> Probably nothing, but consider this scenario and see
if it is possible:
A MiTM is performing an active attack by sending a BU to 
the CN to direct the MN's traffic to itself. 
Now this Bad Guy happens to be on the path between the 
CN and the HA. In this case, if RR (only) is used, 
Bad Guy will be able to steal all the MN connections 
with the CN, and her can keep refreshing the BU to disallow
future communication with that particular Home address. 
However, if RR, combined with CGAs is used, this can not 
happen (well, or it becomes as hard as it is to generate
a duplicate CGA). 
As far as I can see this situation is an 'addition of harm'
compared to today's Internet, and is due to the BU. 
That's why I think RR and CGA are a good combination. 

Have I missed something ?

Hesham

---

From: Michael Thomas <[email-masked]>
Date: Thu, 3 Jan 2002 13:08:13 -0800 (PST)

Hesham,

I thought we agreed that an man in the middle
which would need to be part of the network
(switch/router) was something we could ignore.  As
in, if that happens, BU hijacking is just one of a
nearly infinite number of attacks you could mount
-- most of which have nothing to do with MIP.

Now, if you can show an attack by an end host in
the CN's, MN's or anybody else's network which can
be mounted without requiring a compromised
router/switch I'll be the first one to change my
mind on this. One condition here though: if the
access router/switch can defeat the attack, and
it's localized to an attack on its networks (eg
another CN on the same network segment), it's not
unreasonable to expect that that be part of the
entire RR solution, IMO.

	  Mike

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 4 Jan 2002 03:51:34 +0100 (CET)

> future communication with that particular Home address. 

Yes this is a possible attack.

But you seem to be implicitly claiming that this is worse than today's
IPv4 network with an attacker on the path between the communicating nodes.
That is the argument I don't understand i.e. why is this any more harmful
than the MiTM attacking every TCP connection and UDP "session"? The MiTM
is on the path between the communicating nodes.

> happen (well, or it becomes as hard as it is to generate

I fully agree that RR+CGA doesn't have this problem thus it is more secure.

> compared to today's Internet, and is due to the BU. 

So why is it worse?

  Erik

---

From: Erik Nordmark <[email-masked]>
Date: Fri, 4 Jan 2002 04:04:14 +0100 (CET)

> unreasonable to expect that that be part of the

Mike,

An attacker (e.g. a host) on a multi-access link next to the CN, HA, or MN
can lauch successful attacks against RR in general.
(BU3WAY shows a scheme for preventing attacks on the link attached to the MN
and the rest of the path between the MN and HA.)
This does require that the multi-access link allows anybody to receive
packets (e.g. non-switched Ethernets or 802.11) or using ND/ARP spoofing
to become a MiTM on those links.

But this isn't any worse than IPv4 today either - any host attached e.g. to
a non-switched Ethernet next either of two communicating nodes can use
ARP spoofing and/or snooping packets to become a MiTM for TCP connections
and UDP "sessions".

  Erik