Subject: RE: [mobile-ip] Dynamic Home Agent Address Discovery mechanism

From: [email-masked]
Date: Wed, 18 Jul 2001 11:48:15 -0500

>> * the home agents could require the ICMP Home Agent Address Discovery
>> Request message to be authenticated and they will only reply to valid
>> requests. Requests that do not pass authentication could be silently
>> dropped. (or an error message be sent back, but without the source
address
>> being that of a valid home agent) 

>  What is the advantage to early authentication? There
> would be a lot of work to create a self-authenticating
> Discovery Request for little gain that I can see. It
> seems like it would be a whole lot simpler to let the
> HA reply to any discovery request, but require strong
> authentication for its use as a home agent. (ie, 
> discover/authenticate/BU/use).

The reason for authenticating a Discovery request is to ensure that only
valid MNs obtain the list of HAs serving a subnet or network. Obviously
there are other ways that an attacker can learn about the HAs in a
network, but this approach at least puts in some barriers to having
information about HAs in a network being publicly available (via the
ICMP discovery request). We believe that operators would like to some
extent protect the identity of the HAs in their network. So the
mechanism suggested helps such cases. If a network wants to be open,
then yes you do not need to have the authentication of the discovery
message. But as we mentioned, it's an option that needs to be supported
in the spec. Of course the use of a router on a network as an HA
definitely requires strong authentication in the BU. Is there any reason
why the same authentication requirements be not available for the
discovery message? 

>> * The Home Agent Discovery reply message could be authenticated, and
whereas
>> the currently specified ICMP Home Agent Address Discovery Reply
message
>> contains one or a list of the global unicast IP address of home agent

>> operating on the home link; this information could be encrypted.   

>  Again, what is the advantage? BU's are not encrypted, so
>  you're going to disclose your choice once you select an
>  HA, right?
  
True. The BUs are not encrypted. But an attacker only learns about a
single HA being used by some user as opposed to getting information
about all HAs in a network. I guess it's a matter of making it harder
for the attackers to discover information on HAs. Many different kinds
of attacks could be launched targeting HAs in a network and this could
be at least to some extent made harder if the info about HAs was not
readily available.
Only the attackers on the MN-HA paths would be able to get the serving
HA address which reduces the potential number of attackers
significantly.

---

From: Michael Thomas <[email-masked]>
Date: Wed, 18 Jul 2001 10:46:38 -0700 (PDT)

[email-masked] writes:
 >  Of course the use of a router on a network as an HA

   There's no way to use IPsec to secure an anycast.

   What you're proposing is non-trivial which is why
   it needs a pretty significant amount of justification.

	    Mike