Subject: Re: [MOBILE-IP] authorization to issue a Binding Update for a Home Address

From: Mohan Parthasarathy <[email-masked]>
Date: Thu, 21 Dec 2000 10:25:44 -0800

>
>
> >    2) Phase II SA should use client identifiers to specify the HOME
> address.
> >       This would establish a Phase II IPsec SA to use HOME address as the
> >       source selector.
> >
>
> If you do this, you need a way of binding the home address to the identity
> used in IKE MM.
>
Yes. If i had a policy that says "Phase II identity should be 10.1.1.2
for [email-masked] in Phase I", what prevents  IKE from verifying
that Phase I and Phase II matches the above policy ? The question
of how this policy is obtained by any arbitrary CN is a separate
and important problem i guess.

Even the IPsec architecture document does not describe authorization
well. If a Security gateway is representing some set of hosts H1,
H2 etc how does any other host verify that the security gateway
is authorized to represent H1. Refer to section 4.6.3 in
RFC 2401.

> >But the question is how does one prevent the MN from using somebody
> >else's home address during the phase II SA ? I agree that this
> >is a difficult problem but it would be good to mention this somewhere.
>
> I think you need to think this through now. It's not as simple as you
> might think. There are a number of security vulnerabilities that have
> resulted in the need to sanity check the source IP address, not just use
> the SPI and destination IP address. To my mind, the proposal isn't really
> complete -- IPSEC doesn't provide the necessary
> bindings by itself, and you haven't specified how they are accomplished.
>
> For example, think about the following issues:
>
> a) How is the FQDN/User_FQDN securely bound to the home address? Merely
> convincing someone that I'm fred.bigco.com doesn't tell them anything about
> what home address I'm allowed to use. Are we going to require DNSSEC to
> provide the binding? And is it possible to bind [email-masked] to a
> home address? Here DNSSEC won't even necessarily help you.
>
> b) If you can't accomplish this binding, what use is using the home
> address as the identifier in QM? Any user able to authentication in MM
> can then send in a bogus binding update for another authenticated user.
>
> c) How do the IPSEC correspondents sanity check the source IP addresses?
>
> To be able to do this it seems that you'd need to be able to validate
> the binding between FQDN/USER_FQDN and home address. By the way, if you
> can do this, I don't see the difference between AH and ESP in terms of
> security. If you can't, then neither is really secure. Can someone provide
> a counter example of an attack that could succeed against one and not the
> other?
>
> d) How is "authorization" performed?
>
> I think that this is a code name for FQDN/User_FQDN - home agent binding,
> but I'm not sure.
>
All your problems are valid, may be we should include the IPsec folks
in the discussion.

-mohan