Subject: Re: [mobile-ip] Concern over draft-team-mobileip-mipv6-sec-reqts-00.txt

From: Charlie Perkins <[email-masked]>
Date: Wed, 01 Aug 2001 01:13:42 -0700

>
>  > If a node has no security association with a mobile
>  > node, it cannot authenticate the Binding Update and
>  > it must be ignored.  What else needs to be said?
>  > I don't think this is at all ambiguous.  Thus, it is not
>  > correct to characterize Mobile IPv6 as suffering from
>  > this vulnerability.
>
> Since there isn't sufficient information on _how_
> to authenticated binding updates,

Are you claiming that section 8.2 needs repair?
Or is it that section 4.4 is incomplete?  If the latter,
then what specifically do you think is wrong?
It specifies the data that needs to be authenticated.
The Binding Update (formerly AH) specifies a SPI
which should determine the authentication algorithm.
If there isn't one, there is no authentication.  What's
wrong with that?  What words do you think are
missing?

> the only way to
> interpret what you wrote in light of the analysis
> is that MIPv6 does not have this vulnerability
> because it does not support route
> optimization. This is clearly not very helpful as
> it's obvious that the goal is to have a secure
> route optimization feature as part of the base
> spec, and I'll guess that that was their take on
> the matter as well.

No, what I wrote is that the existing specification
does not have the vulernability, because Binding
Update packets cannot be accepted without
authentication.  It is the authentication requirement
for Binding Updates that makes route optimization
secure.  This requirement has been known for well
over 7 years.  It is not new.  It was never opened
within Mobile IPv6.

I sure do wish someone would explain why there
is some vulnerability, since as best I can tell the
action that would lead to vulnerability is absolutely
prohibited by the specification.

Charlie P.

---

From: Thomas Narten <[email-masked]>
Date: Wed, 01 Aug 2001 07:50:51 -0400

Charlie,

It seems to me that you are to some extent splitting hairs. I'll
concede this particular battle, but that doesn't change that we have
work to do to get the spec to RFC.  In particular:

Charlie Perkins <[email-masked]> writes:

> No, what I wrote is that the existing specification does not have
> the vulernability, because Binding Update packets cannot be accepted
> without authentication.

This is technically correct. If a receiver can't properly authenticate
a BU, it (per the MIPv6 spec) discards it, so technically there is no
vulnerability. But in this case, route optimization doesn't work
either. And presumably people want route optimization to work because
they think it is important. So, I agree, rather than saying "there is
a security vulnerability", we should be saying something rather
different, i.e., additional work needs to done to develop a more
deployable approach to securing BUs in the case of communication
between arbitrary MNs and CNs.

Thomas

---

From: Charlie Perkins <[email-masked]>
Date: Wed, 01 Aug 2001 08:28:23 -0700

Hello Thomas,

Thank you very much for this note. I suddenly no longer
feel that we are living in parallel but disjoint universes.

I thoroughly agree that we have work to do in order to
get Mobile IPv6 to Proposed Standard, and I'm not
adverse to going about getting it done in whatever way
is the most likely to reach the technical goals and attain
consensus within the working group.

However, to me it does not seem at all like splitting
hairs, because of the following:

- The "original" goal was to have a mechanism by which
   route optimization could work, for those hosts able to
   create the appropriate security association.

- The "new" goal is to create a mechanism by which a lot of
  (or maybe all) IPv6 hosts can authenticate the Binding Update.
  This would enable route optimization for a much larger subset
  of all IPv6 correspondent nodes.

That is a big goal.  I think that we are likely to be looking at
some challenging work, so it is crucial to have a precise
understanding of the current problem and the new goals.
I like your formulation of the problem stated in your last
sentence of  the last paragraph.

Regards,
Charlie P.