Subject: RE: [Mipshop] Gauging interest in official WG adoption of IDs

From: "Faccin, Stefano M" <[email-masked]>
Date: Mon, 24 Jul 2006 22:05:01 -0700

Hello all,

Apparently I cannot seem to read my own e-mails. The deadline for
comments is still set for August 8, before we can approve the draft as
WG drafts. My apologies for the confusion..

Stefano

________________________________

From: Faccin, Stefano M 
Sent: Monday, July 24, 2006 6:26 PM
To: Faccin, Stefano M; [email-masked]
Subject: RE: [Mipshop] Gauging interest in official WG adoption of IDs

Hello all,

the two drafts:

- draft-haddad-mipshop-hmipv6-security-04

- draft-arkko-mipshop-cga-cba-04.txt

have been approved as WG drafts. I'd kindly ask the authors to modify
the draft appropriately for the next revision.

Stefano

________________________________

From: Faccin, Stefano M [mailto:[email-masked]] 
Sent: Wednesday, July 19, 2006 11:52 AM
To: [email-masked]
Subject: [Mipshop] Gauging interest in official WG adoption of IDs

Hi,

Last week during the mipshop meeting we talked about 2 potential drafts
up for adoption as official WG drafts. 

So the question to the WG is: should we adopt the following documents as
official WG items (based on the individual drafts as noted below)?

- draft-haddad-mipshop-hmipv6-security-04

- draft-arkko-mipshop-cga-cba-04.txt

Please send comments one way or another through August 8, 2006.

Thanks,

Stefano M. Faccin

Mobility Group - Technology & Standards

Mobility Wireless Group

Intel Corporation

+1 408 966 2334

[email-masked]

  <http://www.intel.com/> 

_______________________________________________
Mipshop mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mipshop

---

From: "Narayanan, Vidya" <[email-masked]>
Date: Thu, 27 Jul 2006 18:29:47 -0700

All,
I read this document and have many concerns, some of them quite
fundamental. I've included my review below (have kept it to the most
important points now) - but, overall, I don't think this document is
ready to be adopted as a WG document. In fact, I have concerns about the
applicability of this document for HMIP6 security itself. Here are some
comments: 

1. The use of CGAs as described is orthogonal to the problem at hand and
doesn't seem to be addressing any needed security. 

2. The DH exchange is unauthenticated and hence subject to MiTM attacks.

3. The solution requires a key to be passed from the AR to the MAP,
which is rather strange - one of the strengths of end node based
mobility management is that the compromise of edge network elements does
not cause redirection attacks. This is directly weakening that aspect. 

4. The fact that there is key transfer between the AR and MAP implies an
SA between the entities. One of the other strengths of end node based
mobility management is that it doesn't require a mesh of SAs between ARs
and a central entity. This directly weakens that aspect as well. 

5. The protocol seems to lack replay protection (no liveness checks
between MN and MAP either). 

6. No reason to tie RCoA to LCoA - RCoA remains the same across changing
LCoAs. 

I have other comments, but, before the above are fixed, it is not worth
getting into those. Also, I strongly believe that IKEv2/IPsec is the
right protocol to use, if we want a DH-based protocol. If this protocol
were to be fixed to authenticate the DH exchange, provide replay
protection and include liveness checks, it will look and smell like
IKEv2 (except for the CGA ties, but then, I don't see why we need the
CGA ties). 

Vidya

	From: Faccin, Stefano M [mailto:[email-masked]] 
	Sent: Monday, July 24, 2006 10:05 PM
	To: Faccin, Stefano M; [email-masked]
	Subject: RE: [Mipshop] Gauging interest in official WG adoption
of IDs

	Hello all,

	Apparently I cannot seem to read my own e-mails. The deadline
for comments is still set for August 8, before we can approve the draft
as WG drafts. My apologies for the confusion..

	Stefano

		From: Faccin, Stefano M 
	Sent: Monday, July 24, 2006 6:26 PM
	To: Faccin, Stefano M; [email-masked]
	Subject: RE: [Mipshop] Gauging interest in official WG adoption
of IDs

	Hello all,

	the two drafts:

	have been approved as WG drafts. I'd kindly ask the authors to
modify the draft appropriately for the next revision.

	Stefano

		From: Faccin, Stefano M
[mailto:[email-masked]] 
	Sent: Wednesday, July 19, 2006 11:52 AM
	To: [email-masked]
	Subject: [Mipshop] Gauging interest in official WG adoption of
IDs

	Hi,

	Last week during the mipshop meeting we talked about 2 potential
drafts up for adoption as official WG drafts. 

	So the question to the WG is: should we adopt the following
documents as official WG items (based on the individual drafts as noted
below)?

	Thanks,

	Stefano M. Faccin

	Mobility Wireless Group

	Intel Corporation

	+1 408 966 2334

	 <http://www.intel.com/>

---

From: Suresh Krishnan <[email-masked]>
Date: Fri, 28 Jul 2006 17:38:28 -0400

Hi Vidya,
   Thanks for the comments. Please find my responses inline.

Cheers
Suresh

> doesn't seem to be addressing any needed security. 

Not really. The public key related to the CGA is used to encrypt the 
messages from the AR to the MN.

> 2. The DH exchange is unauthenticated and hence subject to MiTM attacks.

Again. Not true. The exchange is not subject to MiTM attacks. Since the 
TPHS option contains the hash of the Ks a third party cannot spoof the MAP.

> not cause redirection attacks. This is directly weakening that aspect. 

I fail to see the redirection attack you are talking about. Can you 
actually come up with a scenario.

> and a central entity. This directly weakens that aspect as well. 

It is much easier to set up SAs between the MAP and the limited number 
of ARs in the HMIP domain rather than between the MAP and every MN.

> between MN and MAP either). 

You are right. There is a possible replay attack when the MN does not 
receive the BA the first time around and tries to bind again. We will be 
adding a replay protection mechanism (nonce/timestamp) to eliminate 
this. There are no liveness checks as you say but I fail to see the 
relevance to MN-MAP security.

> 6. No reason to tie RCoA to LCoA - RCoA remains the same across changing

Yes. But there is nothing in the draft which suggests otherwise. The 
RCoA-LCoA binding is required for the initial exchange between the MN 
and the MAP to establish the SA, but not thereafter.

---

From: Lakshminath Dondeti <[email-masked]>
Date: Fri, 28 Jul 2006 17:48:15 -0700

At 02:38 PM 7/28/2006, Suresh Krishnan wrote:
>It is much easier to set up SAs between the MAP and the limited 
>number of ARs in the HMIP domain rather than between the MAP and every MN.

Hi Suresh,

I think the idea is that the MN would have a relationship with a AAA 
server and that it would be a good idea to use that as opposed to 
having the AR distribute keys.  Your approach requires a number of 
new SAs to be setup to establish secure channels between the ARs and 
the MAP, which is unnecessarily complex.

regards,
Lakshminath