Subject: [Hipsec] Rendezvous and tunneling

From: [email-masked] (Julien Laganier)
Date: Mon Apr 4 05:42:00 2005

On Wednesday 30 March 2005 21:08, Henderson, Thomas R wrote:
> -----Original Message-----
> > So I have now three questions before I begin another pass of
> > edition:
> >
> > 1) Should we get rid of I1_TUNNELING mode?
> >
> > 2) Should we get rid of BIDIRECTIONAL mode? If not, what is
> > the usage scenario you have in mind?
> > 
> > 3) Should we specify that the RVS relays I1 _and_ UPDATES? This
> > is required to support double-movement in mobility scenarios.
>
> I am fine with 1 and 2.  As for 3, note that the current mobility
> draft does not address the double-jump problem from the client
> side. Therefore, if UPDATE inclusion gets hairy (i.e., has DoS
> issues), then I would not delay the RVS draft on account of that. 
> On the other hand, if it is a simple extension, then it will
> probably be used by future mobility drafts.

Ok, then I will proceed with (1) and (2). 

Regarding (3), I don't think there's is additional DoS issues we 
should be concerned about.

Potentials attacks involving UPDATE relaying are likely to be less 
severe than those involving I1: The I1 relaying introduces reflexion 
and amplification (because R1 is larger than I1) attacks.

The RVS draft defends against these attacks by HMACing packets relayed 
by the RVS, hence defending against malicious nodes, but not against 
malicious RVS. 

With UPDATEs relaying, the only attacks introduced are reflexion 
attacks: An UPDATE will trigger another UPDATE, which is about the 
same size.

So I would say that we can specify UPDATE relaying, and that it is 
somewhat "easier" to secure than I1 relaying. I might be wrong 
though, and will appreciate if someone can confirm/infirm the above 
analysis.

Thanks.

--julien