Subject: Re: [rrg] RRG recommendation

From: [email-masked] (Noel Chiappa)
Date: Tue, 1 Dec 2009 16:02:23 -0500 (EST)

> From: Patrick Frejborg <[email-masked]>

    > it opens up a possibility to hijack sessions, if the control packets
    > during the session transition are not protected
    > ...
    > But perhaps MPTCP can get around this problem in an easier way?

I dunno - I operate on the principle that anytime there's a binding that can
be changed dynamically, if changing the binding is not protected, then the
binding can be hijacked.

So if, e.g. all potential addresses are listed in the SYN packet, you'd be
safe, because that's not dynamic. It's just as secure as existing TCP, which
depends for security on addresses being 'secure' (i.e. a packet to X is
actually delivered to X) - and you know all the addresses are OK because that
came in the same packet that started the connection.

But if addresses can be added later, then the mechanism for doing so has to
be secured. (Although there are a number of ways to do that; but if there's
a MITM attacker 'simple' things like depending on sequence numbers might not
work.)

	Noel

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 02 Dec 2009 11:02:20 +1300

On 2009-12-02 10:02, Noel Chiappa wrote:
...
> a MITM attacker 'simple' things like depending on sequence numbers might not

Exactly. A lot of the complexity in shim6 comes from this requirement, and
serves as a proof of concept.

    Brian

---

From: Patrick Frejborg <[email-masked]>
Date: Thu, 3 Dec 2009 09:35:06 +0200

> serves as a proof of concept.

If the payload is secured with TLS, do we need to care about the IP
addresses change?
The rogue endpoint shouldn't be able to extract the payload and after
a while the other endpoint should just drop the subflow, since the
subflow is not replying correctly.

Both SCTP and MPTCP uses a 32-bit tag/token to provide a low level
security mechanism, in most cases it is good enough (e.g. web
browsing) - that is at least what the transport folks has concluded
(my interpretation)

And shim6 people have concluded that CGA or HBA must be used.

Why this conflict -  is it due to that IPsec is mandatory in IPv6 and
similar security must be available in shim6?

Or do I miss something?

-- patte

---

From: Christian Vogt <[email-masked]>
Date: Sun, 6 Dec 2009 22:55:45 -0500

Patte -

> similar security must be available in shim6?

No, it is just a different tradeoff between security and complexity.

Note, though, that CGA/HBA alone cannot replace a random-token exchange, 
as an attacker could generate a CGA/HBA at which it is not reachable.

- Christian