Subject: [mobile-ip] RO for nodes that are not mobile?

From: [email-masked]
Date: Fri, 14 Jun 2002 10:49:37 +0200

Hello,

sorry for asking a newbe question, but I am not sure if I have understood well 
RO in MIPv6:

Assume an ongoing IPv6 communication between two nodes A and B, which are not 
mobile, but B implements the CN function of MIPv6. A third node C is located on 
the path between A and B. In my impression, C could send a BU to node B for 
node A including an own "CoA". As far as I have understood the return 
routability test, a correct binding in B can be established if C can intercept 
all packets sent to A's address. Thus, using MIPv6 RO, all packets sent from B 
to A will be delivered to the "CoA" at node C. If node C removes the MH and 
then forwards the packets, node A may not even notice this slight modification 
of routing.

Is this true? Or do I miss something?

Thanks,
Michael

---

From: Alexandru Petrescu<[email-masked]>
Date: 14 Jun 2002 12:34:57 +0200

> then forwards the packets, node A may not even notice this slight modification 

Hey Michael, how are you.

I think you forgot the path towards the HA.  The node B will send the
HoT message towards the HA of node A, and this HA is out of the path
where C is found.

You might worry that an attacker puts node C and C' on both A-B and
B-HA paths but don't worry too much because there might be no
alternative.

Alex

---

From: Jari Arkko <[email-masked]>
Date: Wed, 19 Jun 2002 18:08:49 +0300

> B-HA paths but don't worry too much because there might be no

Don't know if there is an alternative or not. But in any case an attacker
who is on the path between the home and the CN is already today able to
do a lot of damage, e.g. by modifying or blocking packets.

(There are a few minor differences relating to the time that you have to
be on the link vs. the effect of the attack, which I think we have
covered by limiting the lifetimes. There's also been a debate on what
happens if "today"'s security situation in the Internet is changed.
But for now, RR appears quite sufficient for the security of CN binding
updates.)

For additional reading, see

http://www.piuha.net./~jarkko/publications/mipv6/security-considerations-new.txt
http://www.piuha.net./~jarkko/publications/mipv6/Residual_Threats.txt

Jari