Subject: Re: [mobile-ip] Unresolved issue #6: Reuse of nonces

From: Erik Nordmark <[email-masked]>
Date: Wed, 17 Apr 2002 04:49:44 +0200 (CEST)

> Agree with most of the text, except for section 11.
> 
> The actual window of vulnerability is only 
> MAX_RR_BINDING_LIFE (300 seconds). The MAX_COOKIE_LIFE 
> does not add anything to the window of vulnerability. So 
> why not make the MAX_COOKIE_LIFE also 300 seconds. 
> 
> lets assume an MN has initiated an RR test. An on-path
> attacker (CN-HA path) could get hold of K0. For him to 
> launch to attack, he must generate a new K1 with his 
> CoA and send a BU as soon as the CN has sent a BAck to 
> the actual MN. If he does not do it immediately, the 
> packets from the CN will keep going to the right MN. 
> No harm done, till the attacker tries to use K0. And 
> when the attacker does this, he is able to hijack 
> connection for MAX_RR_BINDING_LIFE. Whatever the case,
> the MN would be vulnerable only for MAX_RR_BINDING_LIFE.

That is one type of attack but there are others.

As I understand it an on-path attacker can do a future attack for
the sum of MAX_RR_BINDING_LIFE and MAX_COOKIE_LIFE after having been 
on the path.

So Mallory sits between the HA and CN at time T0.
It does a HoTI/HoT exchange and gets a Home cookie at that time.
Then it is no longer on the path due to Mallory moving (e.g. moving
away from the CN's link).
If Mallory sends a BU just before time T0+MAX_COOKIE_LIFE
it can redirect packets for the MN until time  
T0+MAX_COOKIE_LIFE+MAX_RR_BINDING_LIFE.

Thus if the MN arrives during that time it will not be able to communicate
with the CN unless the MN performs a BU procedure before sending
a single packet to the CN (and expecting to receive something back).

So the time period for this particular threat is the sum of the two times.

  Erik