Subject: Re: [mobile-ip] Mobile Routers support without optimization

From: James Kempf <[email-masked]>
Date: Tue, 21 Aug 2001 09:09:15 -0700 (PDT)

Erik,

>> This "delta" thing between addresses will probably allow an attacker
>> to falsely claim a whole prefix when all he has is in fact some
>> addresses of that prefix.
>> 
>> This however leads to the question: "could a provider assign a prefix
>> (except 2 addresses) to somebody and the 2 addresses to somebody
>> else?"
>
>[Using IPv4 prefixes since they are shorter than IPv6 - and net 10
>to avoid pointing any assigned IP address space.]
>
>A provider might assign
>	10.1.0.0/16 to user A
>	10.2.0.0/16 to user B
>	10.3.0.0/16 to user A
>
>This creates "holes" thus in your proposal this can be used by A to claim
>the space assigned to B.
>

Suppose the protocol requires the CN to authenticate what prefix
A and B are allowed to claim with the HA?

The issue then becomes whether the HA can be trusted. Now, suppose
the protocol requires that the HA be authenticable via a chain
of trust through the routing update authentication mechanism 
used to authenticate OSPF and BGP routes? 

		jak

---

From: Michael Thomas <[email-masked]>
Date: Tue, 21 Aug 2001 13:37:57 -0700 (PDT)

> used to authenticate OSPF and BGP routes? 

   The short answer is that the HA cannot be trusted
   as a blanket statement. The routers which may be
   able to produce a trustworthy answer about a particular
   prefix may have no involvement with mobility at present.

	  Mike

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 23 Aug 2001 09:18:04 +0200 (CEST)

> used to authenticate OSPF and BGP routes? 

The mechanism used to authorize (authenticate isn't really the problem here :-)
routing updates are hop-by-hop i.e. a BGP speaker might have a configured list
of prefixes that peer is allowed to advertise. Due to the aggregation in the
routing tables these authorization choices can't possibly be extract beyond
where aggregation happens.

So I don't see how you can extend this to cover multiple routing
adjacency hops - and that is essentially what you are proposing as far 
as I can tell.

    Erik