Subject: [MEXT] Resolving Issue #2: Removing DHAAD mechanism

From: "Charles E. Perkins" <[email-masked]>
Date: Thu, 04 Sep 2008 15:42:33 -0700

Hello folks,

I have made the revisions to resolve and close Issue #2.
DHAAD has not been removed, but additional text has been
included with more details about the potential security
risk.

Regards,
Charlie P.

------------------------------------------------------------------------
OLD:

15.5.  Dynamic Home Agent Address Discovery

  The dynamic home agent address discovery function could be used to
  learn the addresses of home agents in the home network.

  The ability to learn addresses of nodes may be useful to attackers
  because brute-force scanning of the address space is not practical
  with IPv6.  Thus, they could benefit from any means which make
  mapping the networks easier.  For example, if a security threat
  targeted at routers or even home agents is discovered, having a
  simple ICMP mechanism to easily find out possible targets may prove
  to be an additional (though minor) security risk.

  Apart from discovering the address(es) of home agents, attackers will
  not be able to learn much from this information, and mobile nodes
  cannot be tricked into using wrong home agents, as all other
  communication with the home agents is secure.

NEW:

15.5.  Dynamic Home Agent Address Discovery

  The dynamic home agent address discovery function could be used to
  learn the addresses of home agents in the home network.

  The ability to learn addresses of nodes may be useful to attackers
  because brute-force scanning of the address space is not practical
  with IPv6.  Thus, they could benefit from any means which make
  mapping the networks easier.  For example, if a security threat
  targeted at routers or even home agents is discovered, having a
  simple ICMP mechanism to easily find out possible targets may prove
  to be an additional (though minor) security risk.

  This document does not define any authentication mechanism for
  dynamic home agent address discovery messages. Therefore the home
  agent cannot verify the home address of the mobile node that
  requested the list of home agents.

  Apart from discovering the address(es) of home agents, attackers will
  not be able to learn much from this information, and mobile nodes
  cannot be tricked into using wrong home agents, as all other
  communication with the home agents is secure.

  In cases where additional security is needed, one may consider
  instead the use of MIPv6 bootstrapping [RFC5026] (based on
  DNS SRV Resource Records [RFC2782]) in conjunction with security
  mechanisms suggested in these specifications.  In that solution,
  security is provided by the DNSSEC [RFC4033] framework.  The needed
  pre-configured data on the mobile node for this mechanism is the
  domain name of the mobile service provider, which is marginally better
  than the home subnet prefix.  For the security, a trust anchor which
  dominates the domain is needed.

_______________________________________________
MEXT mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mext