Subject: [Gen-art] Gen-ART Review of draft-ietf-mip6-cn-ipsec-05

From: Christian Vogt <[email-masked]>
Date: Mon, 10 Sep 2007 15:07:53 +0300

I have been selected as the General Area Review Team (Gen-ART)
reviewer for this draft (for background on Gen-ART, please see
http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html).

Please resolve these comments along with any other Last Call comments
you may receive.

Document:  draft-ietf-mip6-cn-ipsec-05
Reviewer:  Christian Vogt
Review Date:  September 10, 2007
IETF LC End Date:  September 9, 2007
IESG Telechat date:  --

Summary:  Ready with nits.

Comments:

An important requirement for IPsec-based protection of Mobile IPv6 route
optimization is that the IPsec security associations are bound to the mobile
node's home address.  A malicious mobile node could otherwise misuse its own
security association for impersonating the home address of a different mobile
node.  The draft ensures this requirement in section 3 by saying that...

>  -  the Traffic Selectors MUST match exclusively the Home Address of
>     the Mobile Node and an address of the Correspondent Node (the
>     address used for communication between peers).

Yet the importance of this requirement, as well as its reason and effect, is
unlikely to become clear to the non-expert reader.  I would recommend adding a
section in the Security Considerations sections elaborating on this.

Three nits in addition:

- Abstract:

>                         This document defines how IPsec can be used
>    between the Mobile Node and Correspondent Nodes for Home Address
>    Option validation (aka. triangular routing) and protection of
>    mobility signaling for Route Optimization.

The phrase "aka. triangular routing" is out of context here.  Just drop it.

- Section 1:  "This document defines an alternative mechanism" --> "...an
alternative mechanism for Mobile IPv6 route optimization"

- Section 3: "anti-replay services MUST be selected" --> "...MUST be enabled"

Best regards,
- Christian

_______________________________________________
Gen-art mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/gen-art

---

From: Francis Dupont <[email-masked]>
Date: Mon, 10 Sep 2007 17:06:01 +0200

In your previous mail you wrote:

=> I reply here because there is a common misconception in this comment.

   An important requirement for IPsec-based protection of Mobile IPv6 route
   optimization is that the IPsec security associations are bound to the mobile
   node's home address.  A malicious mobile node could otherwise misuse its own
   security association for impersonating the home address of a different
   mobile node.  The draft ensures this requirement in section 3 by saying
   that...

   Yet the importance of this requirement, as well as its reason and effect, is
   unlikely to become clear to the non-expert reader.  I would recommend
   adding a section in the Security Considerations sections
   elaborating on this.
   
=> in fact the home address impersonation attack exists only in the
mobile node - home agent case, not in the mobile node - correspondent
case. If a node can use the address of another node to communicate
with the correspondent, establish some security association, etc,
this is an IPsec issue if the address gives some specific authorizations.
The mobility does not change this, in fact it makes just this a bit harder
for a rogue mobile node in visit because of the home agent control.
So in fact the requirement is not for security but only for safety.
BTW I believe the MUST is good and should not be replaced by a SHOULD,
and there will be some new text explaining the requirement.

Thanks

[email-masked]

---

From: Christian Vogt <[email-masked]>
Date: Tue, 11 Sep 2007 09:12:35 +0300

Francis:

> => in fact the home address impersonation attack exists only in the mobile
> node - home agent case, not in the mobile node - correspondent case. If a
> node can use the address of another node to communicate with the
> correspondent, establish some security association, etc, this is an IPsec
> issue if the address gives some specific authorizations.

I do agree with you that the issue is with IPsec IF THE IP ADDRESS IS USED FOR
AUTHORIZATION.  Therefore, in the non-mobile case, IP address ownership may or
may not be important.

However, the specialty of the mobility case is that the IP (home) address is
ALWAYS used for authorization.  The whole purpose of using IPsec is IP (home)
address ownership verification.  This is what is important and should be more
carefully attended to in your draft.

Best regards,
- Christian

---

From: Francis Dupont <[email-masked]>
Date: Tue, 11 Sep 2007 12:05:41 +0200

> issue if the address gives some specific authorizations.
   
   I do agree with you that the issue is with IPsec IF THE IP ADDRESS
   IS USED FOR AUTHORIZATION.  Therefore, in the non-mobile case, IP
   address ownership may or may not be important.
   
   However, the specialty of the mobility case is that the IP (home) address is
   ALWAYS used for authorization.

=> I disagree, the authorization is given to the node.

   The whole purpose of using IPsec is IP (home) address ownership
   verification. 

=> no, the whole purpose of using IPsec is to verify the node doing the
signaling is the node owning the traffic.

   This is what is important and should be more carefully attended to
   in your draft.
   
=> what is really lacking is the goal of the draft: this is not to
provide an absolute security, but to keep in the mobility + IPsec
context at least the same security than in IPsec alone.
 The address ownership issue can be a real one but it is an IPsec issue:
an attacker can not do significantly more damage with a fake home address
than with just a fake address.
 BTW I am not against a SHOULD for the protection of statically assigned
home address. My problem is this is not a real mobility issue so it is
not formelly in the scope of the draft. I propose to put it in the PAD
and SPD examples asked by Sam Hartman.

Regards

---

From: Christian Vogt <[email-masked]>
Date: Wed, 12 Sep 2007 09:31:08 +0300

Francis,

the purpose of Mobile IPv6 is to redirect packets for a home address to a
care-of address.  To authorize such redirection, one needs to ensure that the
node requesting it is the home address owner.  This is why it is necessary to
have a strong binding between an IPsec SA and the home address.

> than with just a fake address.

With IPsec alone, an attacker wouldn't be reachable if it used a fake IP
address.  This is different when you add Mobile IPv6 because the attacker may
then be reachable at the care-of address even if the home address is fake.

- Christian

---

From: Francis Dupont <[email-masked]>
Date: Wed, 12 Sep 2007 09:31:25 +0200

With IPsec alone, an attacker wouldn't be reachable if it used a fake IP
   address.  This is different when you add Mobile IPv6 because the attacker
   may then be reachable at the care-of address even if the home address is
   fake.
   
=> as this is the point we disagree about, just explain how this can happen!

Regards

---

From: Christian Vogt <[email-masked]>
Date: Thu, 13 Sep 2007 18:45:52 +0300

Francis,

unless you bind the IPsec security association to the home address, an 
attacker could send a Binding Update message with a spoofed home address 
using its own IPsec SA.  The correspondent node's IPsec instance would 
accept that message and hand it on to the Mobile IPv6 instance.  The 
Mobile IPv6 instance would rely on the message being authenticated and 
update the binding cache entry for the spoofed home address.

You can eliminate this issue with one or two additional, clarifying 
sentences in your draft.

- Christian

---

From: Francis Dupont <[email-masked]>
Date: Fri, 14 Sep 2007 09:54:04 +0200

=> I agree but I can't see an issue with this: if I remove the word
"home" and all allusions to mobility your statement still applies so
as I've already explained the home address is not special and this kind of
spoofing is not specific to mobility.

=> IMHO it is not reasonable to forbid dynamic addressing in IPsec so
it is not reasonable to forbid dynamic or pseudo-anonymous home addresses
(pseudo-anonymous: which has no particular property attached to it).
 And please note the initial IPsec establishment has to be done before
IPsec can protect the mobility signaling so without asking anything
to IPsec for this IPsec is already at least as good as a return
routability check.
 To finish I've also already stated I am not against a SHOULD for a
protection in the case of statically assigned home addresses:
 - it is easy to do in this case
 - it improves the security
 - as this protection is required in the MN-HA context and in this case
   the simplest way is to encode it in the certificate it should be got
   for free.
To summary if a spoofed home address is accepted it is because the IPsec
configuration was setup to accept it. The only thing we have to do
is to enforce it was not by accident.
   
Regards

---

From: Christian Vogt <[email-masked]>
Date: Mon, 17 Sep 2007 19:05:55 +0300

Francis,

I think we disagree on this issue.  IMO the I-D is missing a clear 
statement that a binding between the home address and IPsec SA is 
required.  If you don't want to add this statement, let's agree to disagree.

Regards,
- Christian