Subject: [MEXT] [RFC3775 changes] Closure on on "Use of DHAAD mechanism"

From: Julien Laganier <[email-masked]>
Date: Thu, 27 Mar 2008 10:24:49 +0100

Folks,

We really need to conclude this discussion. So far 75 (seventy-five!) 
messages have been exchanged on the topic. The new text is supported by 
Georges and JMC, while Alex and Vijay disagree.

What do other people on the list think?

--julien

------------------------------------------------------------------------
OLD:

15.5.  Dynamic Home Agent Address Discovery

   The dynamic home agent address discovery function could be used to
   learn the addresses of home agents in the home network.

   The ability to learn addresses of nodes may be useful to attackers
   because brute-force scanning of the address space is not practical
   with IPv6.  Thus, they could benefit from any means which make
   mapping the networks easier.  For example, if a security threat
   targeted at routers or even home agents is discovered, having a
   simple ICMP mechanism to easily find out possible targets may prove
   to be an additional (though minor) security risk.

   Apart from discovering the address(es) of home agents, attackers will
   not be able to learn much from this information, and mobile nodes
   cannot be tricked into using wrong home agents, as all other
   communication with the home agents is secure.

NEW:

15.5.  Dynamic Home Agent Address Discovery

   The dynamic home agent address discovery function could be used to
   learn the addresses of home agents in the home network.

   The ability to learn addresses of nodes may be useful to attackers
   because brute-force scanning of the address space is not practical
   with IPv6.  Thus, they could benefit from any means which make
   mapping the networks easier.  For example, if a security threat
   targeted at routers or even home agents is discovered, having a
   simple ICMP mechanism to easily find out possible targets may prove
   to be an additional (though minor) security risk.

*  This document does not define any authentication mechanism for 
*  dynamic home agent address discovery messages. Therefore the home
*  agent does not know the identity of the mobile node that requested
*  the list of home agents.

   Apart from discovering the address(es) of home agents, attackers will
   not be able to learn much from this information, and mobile nodes
   cannot be tricked into using wrong home agents, as all other
   communication with the home agents is secure.

*  In cases where security is needed, it is advisable to consider the
*  use of MIPv6 bootstrapping [Boot-Integrated] [Boot-Split], in
*  conjunction with security mechanisms suggested in these
*  specifications, instead of the DHAAD mechanism.
*
*  Finally, it should be noted that the DHAAD mechanism is based on
*  ICMP and as such, it will not work in networks that are configured
*  to block ICMP messages.
------------------------------------------------------------------------
_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 27 Mar 2008 09:00:18 -0500

Hi Julien,

This is tricky without reading the 75 messages! In order to understand the views of both sides. However, just by looking at the delta in the text, I would like to make the following observation & opinion:

It seems that all the new text is already well understood (assuming that the reader is somewhat aware of Client MIP6 and IPv6 etc.) and does not add any new critical information. Probably the only role of the NEW text is to make RFC3775 DHAAD functionality looks bad! I believe the current text is quite clear enough and does not need any further clarification. IMO, we MUST be careful when we introduce a protocol with a specific functionality and at the same time documented risk to come at a later time and trash that functionality by updating the same document! All the other referenced proposals are there and people are aware of them anyway.

Therefore, I would like to support keeping the OLD TEXT as is without modification.

Thanks!

Regards,
Ahmad

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Julien Laganier
> Sent: Thursday, March 27, 2008 4:25 AM
> To: [email-masked]
> Subject: [MEXT] [RFC3775 changes] Closure on on "Use of DHAAD 
> mechanism"
> 
> Folks,
> 
> We really need to conclude this discussion. So far 75 
> (seventy-five!) messages have been exchanged on the topic. 
> The new text is supported by Georges and JMC, while Alex and 
> Vijay disagree.
>