Subject: [Hipsec] Time Window Instead of CBA?

From: [email-masked] (Christian Vogt)
Date: Wed Mar 9 19:07:01 2005

Hi Julien, hi all.

Julien came to the microphone after my presentation today, but we didn't 
have enough time to go into his comment to the extent due.

The question was whether we could not just allow a correspondent node to 
send packets to an unverified locator for a certain time window instead 
of using Credit-Based Authorization.

Intuitively, one would say that this time window should be one RTT, 
which is what a reachability verification takes.  However, since the RTT 
for a new locator may be completely different than a previously computed 
RTT, one would probably end up using a higher, constant value. 
(Besides, it is not clear where to get the RTT from at the IP layer. 
Transport-layer protocols may compute the RTT, but usually do not reset 
this value upon a handover.)

Anyway, no matter what lifetime we pick for an unverified locator, the 
question is:  What would prevent an attacker to re-register an 
unverified locator again and again?  One may argue that the 
correspondent node could require a successful reachability verification 
before allowing a mobile node to register a new unverified locator.  But 
that might cause DoS against an upright mobile node that moves quickly 
enough such that a new locator becomes stale before it can be verified.

Without getting too much into this, I hope this makes clear that finding 
a feasible heuristic for the correspondent node is not easy.  There is 
also some text (section 5.8) in 
draft-irtf-mobopts-ro-enhancements-00.txt.  And I had a slide on this in 
my presentation which I had to skip in the interest of time.  (The 
slides are posted.)

I guess that, in summary, it's feasible to say that heuristics quickly 
become more complex than Credit-Based Authorization.  After all, CBA is 
really not much from an implementation perspective:  It's just some byte 
counting when a packet is received, and checking the current credit 
balance when a packet is to be sent to an unverified locator.  Note that 
one does not need a timer to realize credit aging.

Maybe, other folks have a comment on this as well.

Regards,

- Christian

-- 
Christian Vogt, Institute of Telematics, University of Karlsruhe
www.tm.uka.de/~chvogt/pubkey/

---

From: [email-masked] (Jari Arkko)
Date: Wed Mar 9 20:46:01 2005

Christian Vogt wrote:

> Without getting too much into this, I hope this makes clear that 
> finding a feasible heuristic for the correspondent node is not easy.  
> There is also some text (section 5.8) in 
> draft-irtf-mobopts-ro-enhancements-00.txt.  And I had a slide on this 
> in my presentation which I had to skip in the interest of time.  (The 
> slides are posted.)
>
> become more complex than Credit-Based Authorization.  After all, CBA 
> is really not much from an implementation perspective:  It's just some 
> byte counting when a packet is received, and checking the current 
> credit balance when a packet is to be sent to an unverified locator.  
> Note that one does not need a timer to realize credit aging.

I agree.

--Jari

---

From: [email-masked] (Julien Laganier)
Date: Thu Mar 10 12:38:01 2005

On Thursday 10 March 2005 02:45, Jari Arkko wrote:
> Christian Vogt wrote:
> >
> > I guess that, in summary, it's feasible to say that heuristics
> > quickly become more complex than Credit-Based Authorization. 
> > After all, CBA is really not much from an implementation
> > perspective:  It's just some byte counting when a packet is
> > received, and checking the current credit balance when a packet
> > is to be sent to an unverified locator. Note that one does not
> > need a timer to realize credit aging.
>
> I agree.

Right. After discussing more with Christian I now agree too.

--julien

---

From: [email-masked] (Pekka Nikander)
Date: Thu Mar 10 14:17:00 2005

>> It's just some byte counting when a packet is received, and checking 
>> the current credit balance when a packet is to be sent to an 
>> unverified locator.

Note that in the case of HIP most of the required machinery is already 
there, as the ESP SAs keep a count on bytes anyway.

--Pekka

---

From: [email-masked] (Christian Vogt)
Date: Thu Mar 10 14:33:01 2005

Yes, you can re-use code that exists anyway.

Likewise, in our CBA implementation for Mobile IPv6, we use a 
correspondent node's Binding Cache to store the IP-address state 
(verified, unverified) and a byte counter for each registered mobile 
node.  You can do similar things for HIP mobility as well.

- Christian