Subject: [mobile-ip] CoT

From: "Pascal Thubert" <[email-masked]>
Date: Mon, 1 Jul 2002 11:47:18 +0200

I understand that the RR test is meant for the CN to ensure that the remote
mobile node is actually who he says, at least as far as the Home Agent knows. So
a CN sends a secret via Home, and hopefully the REAL guy gets it. Then the REAL
guy could talk to the CN, using that secret to authenticate himself. Now, what
about the CareOf Test? Seems that is it mostly used to check that the path to
the MN works. To me, it looks like the first beat of a heartbeat more than a
HELLO; we're just missing the next beats to detect when the path becomes
unusable, in which case the home route should be used. Anyway, what bothers me
is that the CareOf address is part of the secret that comes with that test. When
the MN moves, a new test is needed before the BU, correct?

In general, I do not necessarily see the value of that secret in the CoT for
MIP. If the guy at the CoA has the secret from the HoT, then it's him, ain't it?

This line of thinking would end up with a flow like:

1) HoT once
2) BU, based on HoT only, when CoA change
3) CoT as a heartbeat

What do you think?

Pascal

---

From: Jari Arkko <[email-masked]>
Date: Mon, 01 Jul 2002 13:22:08 +0300

> is that the CareOf address is part of the secret that comes with that test. When

The intention of the care-of address test is to protect against
certain types of bombing attacks, as described in section 2.5
of draft-aura-mipv6-bu-attacks-01.txt.

> the MN moves, a new test is needed before the BU, correct?

Correct. That is as intended.

> MIP. If the guy at the CoA has the secret from the HoT, then it's him, ain't it?

The care-of address is used as an input in creating the care-of cookie,
which in turn is used as an input to the correct value of the authenticator
field.

If the authenticator field did not depend on the care-of address and the
cookie sent to that address, the care-of test would not prove that the
MN is live at the care-of address.

Jari