Subject: RE: [mobile-ip] alt-coa - Comments on Draft 16

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Tue, 2 Apr 2002 17:50:25 +0200

> I'm not sure I understand. The MN does need to send an F-BU 
  > to the old
  > AR. That either happens when the MN is on the old link or 
  > on the new.
  > What I'm saying is that I don't believe there needs to be 
  > an RR test on
  > the new CoA because the HI/HAck exchange allows the old AR, which
  > is serving as the on link home agent, can be strongly authenticated.

=> I think that it ultimately comes down to the
basis of the trust between the MN and the 
old AR. Authenticating HI and HAck between
the old and new ARs does not necessarily mean
that the MN is not trying to bomb the new network
does it ?

But everyone seems to assume that it is enough
so what am I missing? 

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Tue, 2 Apr 2002 09:04:39 -0800

Hesham,

> But everyone seems to assume that it is enough

Actually, you are right, there does need to be an
initial bootstrapping of trust between the MN and
the old AR. 

Link security is being discussed on the SEND list
(so far, somewhat inactive). 

            jak

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 3 Apr 2002 10:33:25 +0200 (CEST)

> But everyone seems to assume that it is enough

When oldAR lets the MN get service from the domain
it is exposing the domain to traffic related to this MN - e.g. the MN
could decide to send or receive useless traffic just to create load.
But the domain can limit this "damage" by the link bandwith the MN is
using, and perhaps have ways of allocating cost based on usage (e.g. usage
based billing).

The fact that this ability to consume resources can be transferred between
oldAR and newAR doesn't really add a new threat as far as I can tell -
oldAR and newAR trust eachother and there is a way to prevent others to
fake such transfers.

Hmm - if the link bandwith at oldAR and newAR is X, can a misbehaving
MN use up 2X of resources by pretenting to move to newAR (consuming resources
at newAR by bombing) while in fact remaining at oldAR using the resources.
Could a malicious MN use this to pretend to be at more than 2 CoAs? (oldAR,
newAR1, newAR2, etc even though it has never left oldAR?)

  Erik

---

From: Rajeev Koodli <[email-masked]>
Date: Wed, 03 Apr 2002 11:58:38 -0800

> using, and perhaps have ways of allocating cost based on usage (e.g. usage

I agree. How an AR does traffic conditioning is dependent on
local constraints.

> oldAR and newAR trust eachother and there is a way to prevent others to

To be more specific,

- oldAR has means to trust CoA-1
- old AR trusts new AR, hence trusts CoA-2

> newAR1, newAR2, etc even though it has never left oldAR?)

I don't think so. Until the MN actually announces its attachment
to new AR (via Neighbor Advertisement), the new AR only has
a proxy ND cache entry corresponding to CoA-2. So, if a bogus MN
sends a BU authorizing old AR to redirect traffic to new AR, nobody
other than the new AR sees those packets. Furthermore,  since the new
AR has a very small buffer corresponding to ND cache (1 or two packets),
the MN cannot "bomb" new AR either. Also note that the new AR does
not send any Neighbor Solicitation (since it is proxying CoA-2) when
packets arrive; so I don't see any issue with wasting link bandwidth either.

The same reasoning holds holds for multiple CoAs with the observation
that the MN has to figure out multiple AR prefixes in order to
configure multiple CoAs in the first place.

Regards,

-Rajeev