Subject: RE: [mobile-ip] Question on draft-team-mobileip-mipv6-sec-reqts-00.txt

From: [email-masked]
Date: Mon, 23 Jul 2001 11:30:04 -0500

>  
>Hello, 
>
>This is a very interesting draft ... too bad that the privacy issues
>are not addressed...  
 
Privacy should be dealt with separately. In order to get MIPv6 spec to
PS, we need to solve the more immediate problem.
 
>Anyway i think that requirement H.3 should be: 
>
> "CNs MUST NOT process any packet (BU or not) containing a Home  
>   Address option unless they have verified that that the node sending
>   the packets is authorized to use the home address in the
>   destination option:  
>  
 
The above makes more sense. As you mention, a CN can be made a packet
reflector without creating a binding cache. Thanks for the input.
 
>
>  In fact the MIPv6 draft says : 
>  "A node receiving a packet 
>   that includes a Home Address option MAY implement the processing of 
>   this option by physically exchanging the Home Address option field 
>   with the source IPv6 address in the IPv6 header." 
>
>    An attacker can then easily use a CN as a packet reflector with
>    current MIPv6...  
>    it only needs to send packets with a home address option
>    containing the victim address to several CNs...  
>    CNs will exchanged the source IPv6 address with the vicitim
>    address and reply to the victim ...NO Binding entrie  
>   is necessary for this attack...  
>
>   Am i missing something? 
 
Nope. You are correct.
 
>    thanks, 
>    Claude. 
 
-Basavaraj
>
>-- 
>
>----------------------------------------
>Claude CASTELLUCCIA, INRIA Rhone-Alpes  
>ph:  +33 4.76.61.52.15 (fax: 52.52)
>http://www.inrialpes.fr/planete/
>  
>

---

From: John Wells <[email-masked]>
Date: Mon, 23 Jul 2001 19:17:25 -0400

> PS, we need to solve the more immediate problem.

I've written a report on dealing with privacy issues in a MIPv6
environment, see http://www.ee.vt.edu/~wells.  Lots of little
pieces exist to help ensure privacy (ex. RFC 3041 -- Stateless Address
Autoconf privacy extensions), but as of yet, no comprehensive solution
exists.  Perhaps we should draft up some requirements?

--john

-- 
John WELLS
Virginia Tech Networking and Visualization Lab
PGP Public key: http://www.ee.vt.edu/~wells/pgpkey.txt

---

From: Jean-Michel COMBES <[email-masked]>
Date: Tue, 24 Jul 2001 18:29:35 +0200

Hi,

> PS, we need to solve the more immediate problem.

JMC : ... which is securing BU/BAck (ie. granurality, authorization of
using H@, etc ...)
For more details, see Saturday Michael's email.

Thus, IMHO, it would be preferable to work on two separate drafts :
1. one concerning immediate and _vital_ problem
2. one (which would be a Informal draft) concerning others threats which
are not critical for MIPv6 mecanisms.

> reflector without creating a binding cache. Thanks for the input.

JMC : Not agree. This threat is not specific to MIPv6 (see below). I think
that the actual requirement H.3 is fine.

> >    address and reply to the victim

JMC : In my point of view, the result is like a static host using spoofing
... the only threat that is specific to MIPv6 is on MN using an
unauthorized H@ when it sends BU.

BTW, I don't understand the General Requirement C which is "Identity
verification MUST not rely on the existence of a global PKI". I would
prefer the sentence "Identity verification MAY not rely on the existence of
a global PKI".

Regards.

JMC.

--

France Telecom R&D - DTL/SSR
Jean-Michel COMBES, Internet/Intranet Security
E-Mail : [email-masked]
Phone +33 (0)1 45 29 45 94, Fax +33 (0)1 45 29 65 19
PGP fingerprint : 07C6 37BF 4DE5 1CE1 EEB1 1F13 5D75 9E33 CFA7 0214

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 25 Jul 2001 09:45:04 +0200

> unauthorized H@ when it sends BU.

Jean-Michel...

sure....but in the static host case one might think that "ingress filtering"
might help
solving this specific problem sometimes...
With the HomeAddress option, ingress filtering can't do anything for you
(because
the source address is topologically correct)... this makes the problem more
difficult to
solve and definetly different that the static host case....
I don't think you can argue that "this threat is not specific to MIPv6"....it
is!

Claude.

--

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 25 Jul 2001 09:45:04 +0200

Jean-Michel...

Claude.

--

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 25 Jul 2001 09:45:04 +0200

Jean-Michel...

Claude.

--

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 25 Jul 2001 09:45:04 +0200

Jean-Michel...

Claude.

--

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 25 Jul 2001 09:45:04 +0200

Jean-Michel...

Claude.

--

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 25 Jul 2001 09:45:04 +0200

Jean-Michel...

Claude.

--

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 25 Jul 2001 09:45:04 +0200

Jean-Michel...

Claude.

--

---

From: Claude Castelluccia <[email-masked]>
Date: Wed, 25 Jul 2001 12:18:52 +0200

Hello,

BTW in relation with the MIPv6 security requirement draft, we (Gabriel
Montenegro and myself)  have submitted
a new version of the SUCV draft.
This draft describes the SUCV ID/address concepts and the associated protocol
(SUCVp). It also contains a detailled security
analysis of it...
Comments will be appreciated....
The draft (v1.0) can be retrieved at:
http://www.inrialpes.fr/planete/people/ccastel/draft-montenegro-sucv-01.txt

enjoy it ;-)

Claude.

PS: note we do not consider the draft-team-mobileip-mipv6-sec-reqts-00.txt
draft in our draft since it was not available
at the time we wrote it...

--

---

From: Jean-Michel COMBES <[email-masked]>
Date: Wed, 25 Jul 2001 14:11:02 +0200

Hi Claude,

Claude Castelluccia a écrit :

> sure....but in the static host case one might think that "ingress
> filtering" might help
> With the HomeAddress option, ingress filtering can't do anything for
> you (because
> the source address is topologically correct)...

JMC : You are right.

> this makes the problem more difficult to
> solve

JMC : You are right again. :-)

> and definetly different that the static host case....

JMC : I don't think so. What is ingress filtering ? A mecanism that
filters packets, checks Source Address validity and authorizes (or not)
them to go to their destination. Wrong ? (BTW, is there any draft about
IPv6 Ingress Filtering ?). That's look like AAAv6 with intendant
filtering fonction based on H@.

>
> I don't think you can argue that "this threat is not specific to
> MIPv6"....it is!

JMC : I'm not totally convinced.

JMC.

--

---

From: Jean-Michel COMBES <[email-masked]>
Date: Wed, 25 Jul 2001 14:11:02 +0200

Hi Claude,

JMC : You are right.

JMC.

--

---

From: Jean-Michel COMBES <[email-masked]>
Date: Wed, 25 Jul 2001 14:11:02 +0200

Hi Claude,

JMC : You are right.

JMC.

--

---

From: Jean-Michel COMBES <[email-masked]>
Date: Wed, 25 Jul 2001 14:11:02 +0200

Hi Claude,

JMC : You are right.

JMC.

--

---

From: Jean-Michel COMBES <[email-masked]>
Date: Wed, 25 Jul 2001 14:11:02 +0200

Hi Claude,

JMC : You are right.

JMC.

--

---

From: Jean-Michel COMBES <[email-masked]>
Date: Wed, 25 Jul 2001 14:11:02 +0200

Hi Claude,

JMC : You are right.

JMC.

--

---

From: Jean-Michel COMBES <[email-masked]>
Date: Wed, 25 Jul 2001 14:11:02 +0200

Hi Claude,

JMC : You are right.

JMC.

--