Subject: Re: [nemo] Security considerations for NEMO?

From: Thierry Ernst <[email-masked]>
Date: Wed, 9 Jul 2003 12:42:08 +0900

Dear Souhwan,

> > > We have been working on the threat analysis for NEMO, and we submitted a draft.
> > > You can find my draft on the following location.
> > > http://www.ietf.org/internet-drafts/draft-jung-nemo-threat-analysis-00.txt
> > > 
> > > Our approach is to build a generic threat model and to consider all possible threats from the scratch, which means that the threats are based on the assumption that no security mechanisms are available  for NEMO yet. This may not be true with the new draft of NEMO basic protocol.
> > > In fact, our work was done before the new draft is announced.
> > >  
> > > Anyway, we keep working on updating our draft while analyzing the feasibility of those threats assuming the security mechanisms available in the draft of basic NEMO protocol.
> > > 
> > > Any comments to our draft will be helpful for us to update the draft.

Very interesting document, I was waiting for a contribution on this
subject for a long time. This is a good starting document. I find your
model very useful to list security threats. Probably there will be more
to add. For instance, is there anything to case about in the nested case
?

May I ask you if you already had time to analyse the specific security
threats faced by the implementation of draft-ietf-nemo-basic as it is
written today ? Is this in your plans to add this in your draft ? What
about draft-ietf-nemo-basic 's ability to prevent such threats ?

For instance, in section 3.1, when you speak about man-in-the-middle. I
doubt the BU message defined in draft-ietf-nemo-basic can be compromised
since the MR is authenticated by the HA (but, sure, without the
authentication, the threat would arise). On the other hand, some threats
may not be prevented by the current draft-ietf-nemo-basic draft, so it
would need fixes. qWhat about the authorization to perform the operation
(e.g. sending a BU for a prefix of a specified lenght) ?

In summary, I can see your draft a 1st step of a 3-step complete analysis:
- what are the potential threats
- where NEMO basic support fails to prevent such threats
- how to fix NEMO basic support

Misc comments and questions about your draft:

- FA: you meant to say AR. Note that AR doesn't assign CoA for MRs.

3.1:
- interrupted: intercepted

3.2  
- In this section, I think you don't explain enough what security
  mechanisms are needed to prevent what specific threat.

- Also, I think you go further than where we NEMO is expected to go for
  basic, particularly when you mention the HA-CN portion of the path.

4.
- MR is part of the mobile network, as MNN.
- what's the difference between FN and MNN ?
- FA: AR ?
- MR-A: this terminology is peculiar to draft-wakikawa-nemo-basic
- how a MR can be compromised ? 

5.
- I think you can dropp that section ...

Thanks for the draft,
Thierry

---

From: Thierry Ernst <[email-masked]>
Date: Wed, 9 Jul 2003 12:42:08 +0900

Dear Souhwan,

3.1:

3.2  

4.

5.

Thanks for the draft,
Thierry

---

From: "Souhwan Jung" <[email-masked]>
Date: Fri, 11 Jul 2003 17:28:38 +0900

Dear Thierry,

Please see my replies inline.

> to add. For instance, is there anything to case about in the nested case

Thanks.
Yes. There might be some more issues to think about  including nested cases and multihoming cases.
We will keep working on the issues.

> about draft-ietf-nemo-basic 's ability to prevent such threats ? 

Threats based on basic nemo protocol are the work that we have to do next.
We will refine our draft to describe specific threats against the security mechanisms of the basic nemo protocol.

> (e.g. sending a BU for a prefix of a specified lenght) ?

Do you mean to add authorization operation to the basic nemo protocol, so every client need to get the authrization from HA before it sends BU to HA? Please explain more details.
 
> - how to fix NEMO basic support
 
 That's right. We need to keep updating it based on the discussions and comments from NEMO ML.

> Misc comments and questions about your draft:

We will fix some terminologies and typos.

Regards,

Souhwan

---

From: "Souhwan Jung" <[email-masked]>
Date: Fri, 11 Jul 2003 17:28:38 +0900

Dear Thierry,

Thanks.

 

Regards,

Souhwan

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 11 Jul 2003 10:34:22 -0700

> We will refine our draft to describe specific threats against the security mechanisms of the basic nemo protocol.

good. this will be useful. and when you analyze the threats
keep in mind that NEMO signaling is always authenticated.

and also please discard those threats which arise from
a compromised Access Router. this is not specific to NEMO.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Fri, 11 Jul 2003 10:34:22 -0700

Vijay