Subject: RE: [mobile-ip] draft-levkowetz-mobileip-nat-tunnel-00.txt security

From: "Sami Vaarala" <[email-masked]>
Date: Tue, 30 Apr 2002 15:30:09 +0300

Francis,

> -----Original Message-----
> From: Francis Dupont [mailto:[email-masked]]
> Sent: 30 April 2002 14:58
> To: Sami Vaarala
> Cc: Henrik Levkowetz; [email-masked]
> Subject: Re: [mobile-ip] draft-levkowetz-mobileip-nat-tunnel-00.txt
> security
> 
>  In your previous mail you wrote:
> 
>    In order to hijack the mobility binding, the attacker must reside
>    on the path between the MN and the HA, and would thus be able to
>    read the traffic (regardless of NAT traversal).  I.e., the attack
on
>    confidentiality is not NAT traversal specific?  Or did you have
>    some other concern?
> 
> => now I can see your argument. I still believe mobility introduces
> a difference because in order to redirect the traffic an attacker
needs
> only to hijack the BU. For instance it doesn't need to stay on the
path
> (where it could get everything with and without mobility).
>  So I am still in favor to keep a short statement about IPsec in order
> to encourage this counter-measure to this part of the threat.

Yes, I understand what you mean.  So we should say that keeping the
mobility binding lifetime short limits the impact of the hijack attack
when the attacker leaves the link after spoofing the RRQ.  Similarly,
use of IPsec provides confidentiality in the same situation.

Best regards,

-Sami

---

From: Hans Sjöstrand <[email-masked]>
Date: Tue, 30 Apr 2002 15:18:29 +0200

>use of IPsec provides confidentiality in the same situation.
What the attacker acheives is an eavesdrop in one direction for the 
duration of the registration. Because the redirect is only valid for the 
traffic going from the HA to the MN, the traffic from HA to MN is 
unaffected.

For this he has to actively change the source address of the RRQ in an 
intermediate node to an address which most probably is topologically 
incorrect and risk to have the packets dropped. This instead of just 
passively listening from the position he has, in the path, adn get both 
directions.

given this and the fact that it's a given and well known fact that 
mobile ip doens't supply you with integrety I think that it will rather 
confuse than enlight people to start recommending ipsec becuase of these 
extensions. It will just raise new issues adn new questions. Is it the 
control messages that should be ipseced ? what ipsec, AH? Is it related 
to port 443 ?

So yes, inform people of the new threats but I don't think we should 
recomend ipsec as some kind of saviour. Because it's not. He could 
eavesdrop before and he could do it now. So ipsec is equally applicable 
to pure mobile ip and has very little to do with nat traversal 
extensions. And the dos case ipsec doesn't help at all.

Regards
/// Hasse