Subject: [Hipsec] MM: Using UPDATEs for RR

From: [email-masked] (Jonathan Wood)
Date: Thu Apr 29 18:12:02 2004

Hi,

I have a question about using UPDATEs without
NES parameters (i.e. containing only the UPDATE-ID
parameter) for RR. Is this method open to an attack
where the attacker can (easily) guess the update ID
and generate a valid UPDATE response? Since the
update ID increases by one each time and starts at
1, it is easy to guess.

For example:

1. MN sends CN a bogus address REA.
2. Peer sends MN an UPDATE request with the
     UPDATE_ID parameter (without a NES) to
     the bogus address.
3. MN waits a bit to give CN time to send the UPDATE
     request, guesses the update ID, and
     sends an UPDATE response to the CN.
4. Response looks OK to CN, so it starts using the
     bogus address.

Or am I missing something?

Jon