Subject: [Mip6] RE: What are we protecting over IPv4 in DS-MIP6?

From: "Soliman, Hesham" <[email-masked]>
Date: Thu, 2 Nov 2006 03:30:59 -0800

Hi Vidya and Vijay,  

Vijay wrote: 
 > > ok. stepping back a bit, I will let the WG decide whether we 
 > > want to add a return routability check for the IPv4 CoA. it 
 > > will work of course.
 > > 
 > > my preference would be not to add this since it adds a round 
 > > trip, making it two round trips every time you send a BU.

=> I tend to agree with that, for this reason and IMO another stronger
reason below.

Vidya wrote:
 > > 
 > 
 > That is not the question. The question is whether it is 
 > important to protect against redirection attacks while 
 > traversing IPv4 networks. 

=> This is 100% correct. This is the right question that should be asked
IMO.

   I believe it is. 

=> I'm not too sure about this one :). I agree with you that the attack
is valid and one would think that if we're starting the Internet today
we should fix it. But let's look at this from an Internet security point
of view. If you're interested in avoiding additional vulnerabilities
introduced on the Internet, then I'm afraid it's a bit late to do that
now. I find the "do no harm" concept that we used with MIPv6 very useful
here. The attack you're referring is obviously specific to IPv4 and NAT.
It is also doable today with existing MIPv4 and NAT traversal, right? So
we're not adding threats that do not exist today, we're simply adapting
what was done in MIPv4 to MIPv6 in private v4 networks. 

In other words, if we want to stick to "accepted" and "documented"
threats, then we don't need the reachability check here if it was not
done elsewhere. I believe this is an acceptable approach, but I'm open
to counter arguments of course.

Hesham

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 02 Nov 2006 08:58:38 -0800

> to counter arguments of course.

I agree.

Vijay

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 02 Nov 2006 08:58:38 -0800

I agree.

Vijay