Subject: Re: a response to "A Simple Solution for IPv6 Multihoming"

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 16 Sep 1999 12:50:56 -0400

In message <Roam.SIMC.2.0.6.937499361.10067.nordmark@jurassic>, Erik Nordmark w
rites:

> I'd agree that for the general case of session survivability you need
> authentication during the recovery i.e. when the session switches to using
> the new addresses.
> But it appears that when indentifiers and locators are separated
> the *all* or *most* of the packets need to be authenticated to avoid
> creating security holes not present in the current architecture.

I mostly agree -- I'd change your note to say that that applies to sessions 
where you care about the integrity of the data.  I'm not convinced that that 
applies to most http traffic, and that's ~75% of backbone traffic today.

Of course, sessions can be hijacked today, on IPv4 -- in fact, I saw a pointer 
to a canned tool go past on some mailing list just this morning.  But there's 
no doubt that most forms of separate identifier and locator lower the 
threshhold of difficulty for the attacker.

		--Steve Bellovin

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 16 Sep 1999 10:23:03 -0700 (PDT)

> applies to most http traffic, and that's ~75% of backbone traffic today.

One could envision a future where AH would be also used as a course level 
filter against DoS attacks. Traffic protected by AH is less likely to
be a DoS attack (since the attackers would have provided a certificate
which can be used to hunt them down). In such a world a node could
be more suspicious (rate limiting things, logging more things, etc) for
requests that are not covered by AH or ESP. This would be useful
for http as well as other traffic.

In addition using AH for http traffic protects TCP i.e. no injected TCP RST
packets.

So even though it is likely to take a lot longer (if ever) for http to use
IPsec I think we need to keep in mind that at some day all traffic might
benefit enough from end-end IPsec.

   Erik