Subject: [mobile-ip] New draft on Mobile IPv6 RO Security Design background

From: Pekka Nikander <[email-masked]>
Date: Tue, 08 Apr 2003 13:34:02 +0300

About a year ago I promised to write a document
that describes the design rationale behind the
current Mobile IPv6 Return Routability security
procedure.

The document is now available as an Internet draft:
http://www.ietf.org/internet-drafts/draft-nikander-mobileip-v6-ro-sec-00.txt

An HTML version, with pretty pictures, is available at
http://www.tml.hut.fi/~pnr/MIP/draft-nikander-mobileip-v6-ro-sec-00.html

Gabriel has promised to do any future editing on
the draft, so please send editorial comments to him.

If there is something substantial, feel free to contact
me or post to the list.  Since the intention of the
document is to help you to understand the underlying
reasons, if there is something that you don't understand
even if you try hard, please tell us.  We may try to include
more or better explanation.

--Pekka Nikander

---

From: Sathya Narayanan <[email-masked]>
Date: Thu, 10 Apr 2003 16:05:58 -0400

Pekka -

I would like to thank you for this document. I found it very useful.

I have few comments:
   Section 3.3.1: first paragraph, last line states "Since the packet arrives
via the home agent, the
   mobile node would automatically start the BU protocol with the
   correspondent node,"
Is the initiation of BU protocol automatic? Is it required to be automatic? If
"route optimization" is (made)
non-automatic, the security threats discussed in section 3.3.1 and 3.3.2 can be
easily avoided.

   Section 4.2: third paragraph, first two sub-paragraphs:
   "The source address must be equal to the source address used in the
CoTI message.

     This must be the same address that was used as the source address
     for the HoTI message and as the destination address for the HoT
     message."
This is confusing. Don't the source address of CoTI and the source address of
HOTI have to be different?

Gabriel: I wrote down a few minor editorial comments, I can send them to you
whenever you want
them.

thanks
Sathya

---

From: Jari Arkko <[email-masked]>
Date: Fri, 11 Apr 2003 08:03:43 +0300

> non-automatic, the security threats discussed in section 3.3.1 and 3.3.2 can be

Well, the base specification has a MAY in 11.7.2 for this
"automatic start". So its not like this would necessarily happen
every time. Specific implementations are likely to use some
heuristics about the situation, maybe even some cross-layer
information to decide when to initiate RO.

Still, it doesn't really help with the attack. RO is initiated
under certain situations and its probably easy to figure out how
to fool the heuristic rules to start it. And the IP stack will
in any case operate automatically in the sense that e.g. there's
no user confirmation involved in starting RO.

> HOTI have to be different?

The text is not right. Here's a fix:

    The care-of address specified in the Binding Update must be equal
    to the source address used in the Care-of Test Init message.

    The home address specified in the Binding Update must be equal
    to the source address used in the Home Test Init message.

Jari

---

From: Pekka Nikander <[email-masked]>
Date: Fri, 11 Apr 2003 08:34:19 +0300

Sathya, Gab,

I don't have anything to add to Jari's message.  A paragraph
to 3.3.1 referring directly 11.7.2. in the base spec would
be good.  The suggested fix for 4.2 is ok, even though it
would be better to explicitly talk about Alt-CoA problems
somewhere.

--Pekka

Jari Arkko wrote:
>>    Section 3.3.1:

---

From: Pekka Nikander <[email-masked]>
Date: Fri, 11 Apr 2003 08:41:24 +0300

Sathya, Gab,

--Pekka