Subject: RE: Revising the Spec (was :Re: [mobile-ip] FMIPv6: Sending FBU from the new link)

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 13 Mar 2003 10:18:52 -0800

James,

I have not followed all of the discussion as i just found out that there
is a problem with the hop count on our mail server. Anyway, one observation
below.

> 
> > Other proposals I've heard are to fall back to the old 
> MIPv4 approach of
> > having an authenticator on the FBU message, but I believe 
> that is not such a
> > good idea because it doesn't address the threat of a cycle 
> denial of service
> > attack, .....
> >
> > MK>> IMO sending an FBU to the oAR is like sending BU to 
> HA. Why sending FBU
> > to the pAR cause such a threat while BU to HA doesn't?
> >
> 
> Because the packet gets dropped in the SAD filter prior to 
> any crypto being done
> on it. That's essentially equivalent computationally to using

MN1 can send a binding update for MN2 (they have to be same on
the same link to make sure the ingress filtering on care of
address check succeeds), which cannot be found until you
do the crypto on it. SAD checks come after the IPsec processing.
So, i am missing something here.
 
> the TTL to filter,
> which is how RFC 2461 and SEND do it.

Either the FBU comes from the wireless link or from the nAR which
is protected by an SA (oAR - nAR). Why would this be an issue ?

thanks
-mohan

>             jak

---

From: "James Kempf" <[email-masked]>
Date: Thu, 13 Mar 2003 11:18:58 -0800

> So, i am missing something here.

OK so there would be an issue if the two MNs shared an HA.

But wouldn't filtering be done on a random node sending BUs to the HA prior to
the crypto being done? Any IPsec experts out there care to comment?

> is protected by an SA (oAR - nAR). Why would this be an issue ?

The SA is the issue. What is it? How is it set up?

I've been proposing to use the SEND SA and to always signal the current AR, and
have the current AR take care of making the routing change, passing along some
kind of mobile authorization token.

            jak