Subject: RE: [mobile-ip] Unresolved issue #5: Alternate CoA

From: "Peter Grimstrup (TED)" <[email-masked]>
Date: Wed, 10 Apr 2002 10:24:29 +0200

Question/comment inline

	Peter

> -----Original Message-----
> From: Francis Dupont [mailto:[email-masked]]
> Sent: 10. april 2002 10:11
> To: [email-masked]
> Cc: [email-masked]'
> Subject: Re: [mobile-ip] Unresolved issue #5: Alternate CoA 
> 
> 
>    Question: Should this vulnerability be closed? If it is closed
>    by requiring the RR and Alternative CoA parameter to use the
>    same CoA, will the remaining Alternative CoA be useful for FMIP,
>    HMIP, and other MIPv6 extensions that may use it.
>    
> => alternative CoA is the common way to repeat the CoA when the BU
> is protected by ESP so we really need it.

This is an argument to have a duplicate CoA field in the BU.
Do you see any need to have an alternative CoA (different from the
IP header source)?

> BTW I don't believe in attacks using a fake CoA because the real Home
> Address will be in the RH in all packets/fragments so the 
> only difference
> with a direct attack is the fake CoA adds a reflection...
> 
>    Text: State the following under 5.1.7:
>    ...
> 
> => agree
> 
> [email-masked]
>

---

From: Francis Dupont <[email-masked]>
Date: Wed, 10 Apr 2002 10:45:25 +0200

=> I agree that duplicated is not different but as soon as only one
of the two CoAs matters there is no reason to enforce they are the same,
i.e. the "alternative CoA" is an elegant way to solve both the
duplication and alternative issues.

=> in the past I heavily used the alternative CoA for deregistration
(using the unregistered home link-local address as the real source
of the deregistration packet (BU where CoA == Home Address)).

Regards

---

From: Jari Arkko <[email-masked]>
Date: Wed, 10 Apr 2002 20:19:35 +0300

> of the deregistration packet (BU where CoA == Home Address)).

This should work as long as the deregistration contains a "proof" that
it has been sent by the right MN, i.e. the RR home cookie and a care-of
cookie both for the same address.

Come to think of it, should we allow a BU with just the home cookie if
the CoA is HoA? Or change the cookie calculation rules so that they are
the same for both HoT and CoT... I'm not sure about the security aspects
though. This might create some new attacks and at least I haven't analyzed
this before.

Jari

---

From: Francis Dupont <[email-masked]>
Date: Thu, 11 Apr 2002 10:10:37 +0200

=> (home) deregistration is with the HA so you have all the proofs
you'd like with strong authentication, etc.

=> binding deletion is a case a long/medium term BSA should make things
simpler.

Regards