Subject: [nemo] Comments on draft-jung-nemo-threat-analysis-00

From: Alexandru Petrescu <[email-masked]>
Date: Thu, 03 Jul 2003 19:27:04 +0200

Hello to authors of draft-jung-nemo-threat-analysis-00.txt.

Thanks for this beginning of threat analysis.  As you think, I also
think it is important for this group's agenda.

But I hope there are many things that could be refined in the draft.
For example, most of the threats stay too generic and sometimes don't
capture the essence of all the discussions that happened on the list.

Some of the threats are not specifically related to the way the base
spec works, but are more related to generic security threats.  All
eavesdropping/monitoring/traffic analysis applies.

Some threats specifically say that IPsec might help there, others don't
say anything; e.g. it's excellent to have text that says IPsec helps
with MiTM between MR and HA, so it would also be fine to have saying
IPsec helps with e.g. 3.2. messages between MR and HA.

> All the data packets between MR and HA have to go through the 
> bi-directional tunnel. This tunnel should be secured by IPsec. But 
> some of the routing information that may not go through this tunnel 
> should be secured.

I don't think there is any routing information that won't go through
that secured tunnel, isn't it?

> The location of MR or MNN inside the subnet may be the privacy of the
>  client, so the location information while network is in motion 
> should be secured. Attacker can analyze the header information MR-CoA
>  in the tunneled data packet and identify the location of the MR. 
> Since all the data packets between MNN and CN are also tunneled using
>  MR-CoA as new source address, the location of the MNN can also be 
> disclosed.

Location privacy risks have been largely discussed on the list and there
are some conclusions.  For example, if the IPsec MR-HA tunnel is made of
steel then nobody can look inside, so attacker can't make an association
between the HoA (invisible) and the visible CoA.

But maybe this section can be further detailed to say more precisely who
is the attacker and what is the sensitive information (e.g. attacker can
not be CN because all communication goes through HA; also the sensitive
information is the HoA, not the CoA, because the CoA must always be in
clear).

Also there was relevant discussion on the list about other security
risks more pertinent to NEMO, like for example when the MR belongs to an
admin domain and the HA to another domain (IIRC).

Thanks again for the draft,

Alex
GBU