Subject: Re: [mobile-ip] closing issue 10 (esp vs ah)

From: Erik Nordmark <[email-masked]>
Date: Tue, 2 Jul 2002 13:22:42 +0200 (CEST)

> I'm not sure that understand/buy this
> prerequisite. I should be able to have multiple
> addresses covered by a single SA/SPI, right? This
> is irrespective of binding updates, and is just a
> general feature of IPsec. What we clearly want to
> prevent is a mobile node hijacking another node's
> legitimate use of an IP address on that subnet.
> But we clearly want mobile nodes to be able to use
> stateless autoconf and/or rfc 3041 addresses, most
> likely at the same time, and we want to allow the
> MN to use mobility for those addresses if it so
> desires. Thus, it seems to me that you have a way
> to protect multiple addresses under a single SPI
> for which it should be possible to change their
> attachment point (ie, send a BU).

Mike,

There seems to be a fundamental conflict between the two requirements 
 - another MN should not be able to "steal" traffic for somebody elses
   HoA (on the same HA)
 - an MN should be able to use RFC 3041 to pick random numbers as temporary
   home addresses
Combining those two, how can the HA determine which MN "owns" which RFC 3041
address?

For stateless addrconf, even with site or subnet renumbering, the situation
is a little simpler because the HA can at least predict the HoAs based on
the prefix and the interface ID that the MN is using.

But in essence this is a variant of the threats in 
draft-kempf-ipng-netaccess-threats-03.txt applied to the home link
and with the BU being a layer of indirection between the (mutually untrusting)
MNs and the neighbor discovery messages on the home link.

I think was is needed for RFC 3041 home addresses to work seemlessly is
 - a mechanism by which MNs can claim and release RFC 3041 addresses 
   using an manual SA (or certificate) tied to a non-temporary home address.
 - a mechanism and policy on the HA which prevents one MN from stealing an
   already used temporary address. A reasonable policy might be 
   first-come-first-served with the HA retaining state about the "reserved"
   temporary addresses.
 - a policy on the HA that prevents a misbehaving MNs from taking all 2^63 
   temporary addresses. For instance, with current RFC 3041 it would be 
   sufficient to allow each MN to use 7 concurrent temporary addresses (per
   home subnet prefix)

The first item could be overloaded on the BU but I think this requires
extreme care. For instance, a temporary address might be allocated by an
MN for 7 days per RFC 3041, and I don't think this allocation should expire
because the home registration for either the temporary address or the
non-temporary address expires.
So at least conceptually there is a need for "temporary home address 
reservation" protocol to make this seamless.

  Erik

---

From: Michael Thomas <[email-masked]>
Date: Wed, 3 Jul 2002 11:06:49 -0700 (PDT)

I'm somewhat behind here, but Erik's note seems
to capture most of the questions raised...

 > Combining those two, how can the HA determine which MN "owns" which RFC 3041

How is it that one does that without any crypto to
complicate the picture? This seems to me to be the
essence of DAD: you can use an address so long as
nobody else is currently using it. Is this
adequate? Well, you tell me. There's an obvious
hijacking attack inherent with DAD, but by
ignoring it you sidestep the sticky questions
about "ownership". Crypto here doesn't really
change that question: just because you could
conceivably use strong auth to close that hole
doesn't mean you are *obligated* to close that
hole. Indeed, there's significant downside to
conflating addresses with identity, so it may well
be better to let sleeping dogs lay.

 >    sufficient to allow each MN to use 7 concurrent temporary addresses (per

I think what needs to be asked first is whether a
strict binding of identity to ip address (cf
"ownership") is even a good idea. I don't think
that is at all clear. In fact it may well be
harmful.

		Mike

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 4 Jul 2002 16:24:30 +0200 (CEST)

> be better to let sleeping dogs lay.

See below.

> that is at all clear. In fact it may well be

Perhaps the term "ownership" carries very wrong connotations in this context.
The issue isn't identity, but the stability of the address.
[As an aside, I didn't think "owership" in the real aka non-IETF world implied
a tie to an identity. I own the 20 Euro bill in my wallet but there is
no relationship between it and my identity.]

Being able to use temporary addresses seems like a very useful thing in
general. Folks are concerns about the threats for public multi-access links
(ND and addrconf threats). To make temporary addresses useful in the SeND
case, there has to be a notion of being able to "allocate" such an
address and be able to use it for its intended lifetime (7 days by default).
In the non-mobile case the unstated assumption is that the node needs
to be present on the link to be able to "defend" an address by responding to
DAD probes. Perhaps this assumption needs to be questioned in general.
In any case, in the mobile case the assumption is bad if it ends up assuming
that the MN is always reachable from the HA.

But this "stable temporary addresses" doesn't mean that the addresses should
be tied to a particular identity of the owner; merely that attackers should not
be able to (easily) steal them from the owner.

  Erik