Subject: [Mip6] Question on secured Alternate CoA

From: Alexandru Petrescu <[email-masked]>
Date: Wed, 24 Dec 2003 22:34:28 +0100

Hi,

Sorry if this has been asked before, or if my reading is incomplete.

Can an MN send a BU to its HA _without_ the Alternate CoA option?

The current MN-HA security spec seems (in my interpretation) to require
the CoA of a MN away from home to be present in the Alternate CoA
mobility option field of a Binding Update Message in a Mobility Header
(section 3.1 of draft-06) in order to "ensure that the CoA is protected
by ESP".

Since draft-mobileipv6-24 says MN SHOULD use ESP to to protect the BU
and the MN-HA security spec says that the Alternate CoA field MUST
support the ACoA address, this almost boils down to always use the ACoA
field equalling the src address CoA.

So I was wondering whether it is still legal for MN to send BU's
protected by ESP in transport mode to its HA (no RO), but without the
Alternate CoA field.

Thanks,

Alex

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Jari Arkko <[email-masked]>
Date: Fri, 26 Dec 2003 12:09:58 +0200

> protected by ESP in transport mode to its HA (no RO), but without the

It is, but only when you are home. Section 4.3:

    o  When ESP is used to protect Binding Updates, there is no
       protection for the care-of address which appears in the IPv6
       header outside the area protected by ESP.  It is important for the
       home agent to verify that the care-of address has not been
       tampered with.  As a result, the attacker would have redirected
       the mobile node's traffic to another address.  In order to prevent
       this, Mobile IPv6 implementations MUST use the Alternate Care-of
       Address mobility option in Binding Updates sent by mobile nodes
       while away from home.  The exception to this is when the mobile
       node returns home and sends a Binding Update to the home agent in
       order to de-register.  In this case no Alternate Care-of Address
       option is needed, as described in Section 3.1.

I guess this also implies that if a home agent receives a BU with
no alternate care-of address moboption, and source address NOT equal
to the home address, the packet should be dropped.

--Jari