Subject: [mobile-ip] ha-ipsec issue #270: alt-coa in dereg or not?

From: Jari Arkko <[email-masked]>
Date: Fri, 07 Mar 2003 15:24:08 +0200

Vijay said:
-----------

I didnt notice this before.

 >   When the mobile node is at home, the above rules are different as the
 >   mobile node can use its home address as a source address.  This
 >   typically happens for the de-registration Binding Update when the
 >   mobile is returning home.  In this situation, the Binding Updates
 >   MUST support at least the following headers in the following order:
 >
 >      IPv6 header (source = home address,
 >                   destination = home agent)
 >      ESP header
 >      Mobility header
 >         Binding Update
 >            Alternative Care-of Address option (care-of address)
 >

It is a deregistration BU. I am not sure if the alt-CoA option will
ever be added to a deregistration BU from the home link.

I said:
-------

Actually, ha-ipsec 3.1 and 4.3 agree on this: every
binding update protected by esp needs to contain
alt-coa. However, base 11.7.1 says "registrations", which
doesn't cover de-reg BUs. So we have an inconsistency here.

The right thing would appear to be mandatory use of alt-coa
on all of them because otherwise an attacker can convert
the de-registration to a registration. No, wait! Actually
since the lifetime is zero, our current rules say that's
a deregistration anyway.

In conclusion, maybe be base doesn't need to be changed (relief!)
and ha-ipsec indeed needs to change, both 3.1 and 4.3. The
change is deleting alt-coa from 3.1 and saying "registrations"
instead of "all binding updates" in 4.3.

How does that sound?

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 07 Mar 2003 16:24:08 -0800

sounds good. please close the issue.

Vijay