Subject: Re: [mobile-ip] Last Call Comments on http://www.ietf.org/internet-drafts/draft-ietf-mobileip-mipv6-scrty-reqts-01.txt

From: "Venkata Jagana" <[email-masked]>
Date: Mon, 29 Oct 2001 10:12:20 -0800

Hello Jari,

>> The solution, that I have in my mind, can be simply to look at the
>> CN's binding cache upon receipt of incoming packet and validate that
>> 'src and home address' of the packet matches with CN's CoA <-> Home
>> Address binding before accepting it for further processing. In fact,
this

>If you did this, wouldn't it mean that Route Optimization is mandatory to
use
>in all Mobile IPv6 communications? This would be a big change.

When home address option is used, does't it mean that it is already using
route optimization. Not sure though, whether home address option is used
in cases other than route optimization.

>Also,how would the first BU packet get validated by this rule?!

Either stand-alone first (or subsequent) BU's or BU's included in the
data packets are authenticated and so, I guess this rule is not an
issue at all. The problem comes for the unathenticated data packets
containing the home address option and this solution should solve
this problem.

Thanks,
Venkat

----------------------------------------------------------------
Venkata R Jagana
IBM Linux Technology Centre, Beaverton
[email-masked]
Tel: (503) 578 3430 T/L 775-3430

---

From: "Venkata Jagana" <[email-masked]>
Date: Mon, 29 Oct 2001 10:19:04 -0800

Hello Pekka,

> AFAICS, most of theses issues were brought up and discussed somewhat
> during the last two weeks.  Some description of the problem is at:

http://www.ietf.org/internet-drafts/draft-savola-ipv6-rh-ha-security-00.txt

Thanks. I would look into this draft and let you know if I have
any comments.

Thanks,
Venkat

Pekka Savola <[email-masked]> on 10/26/2001 10:15:33 PM

To:   <[email-masked]>
cc:   Alper Yegin <[email-masked]>, Venkata
      Jagana/Beaverton/IBM@IBMUS
Subject:  Re: [mobile-ip] Last Call Comments on
      http://www.ietf.org/internet-drafts/draft-ietf-mobileip-mipv6-scrty-reqts-01.txt

On Fri, 26 Oct 2001, Venkata Jagana wrote:
> What a coincidence! I am little bit late in sending out the exactly
> similar thought that I have on this security hole and the corresponding
> enhancement.
>
> In fact, I believe, the malicious node don't even need to know the CoA
> of MN and the home address is more than sufficient for it to send a
> packet with arbitrary src address in the packet to CN. As per
> the current MIpv6 draft, CN  would have to simply replace the 'src'
> address of IPv6 packet by the home address in the home address option
> in the incoming packet without any further validations and this is a
> problem.
>
> Address binding before accepting it for further processing. In fact, this
> binding cache is already consulted for outgoing packets and it needs
> to be done for incoming packets as well in order to address this
> security concern and so, this may not be a real overhead since it is
> a simple lookup. However, this solution may not really work well in
> case where the malicious node somehow steals both CoA and Home address
> of MN and I guess that's always an issue anyway.

AFAICS, most of theses issues were brought up and discussed somewhat
during the last two weeks.  Some description of the problem is at:

http://www.ietf.org/internet-drafts/draft-savola-ipv6-rh-ha-security-00.txt

--
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords