Subject: Re: [mobile-ip] Last Call Comments draft-ietf-mobileip-mipv6-scrty-reqts-01.txt

From: James Kempf <[email-masked]>
Date: Thu, 18 Oct 2001 16:38:14 -0700 (PDT)

Pekkka,

Comments embedded.
> 
> > > In general, the document seems very heavily
> weighed
> > > towards MN/CN security threats and very lightly
> > > weighted towards MN/AR threats. Some of the
> MN/CN
> > > threats are redundant. There are 18 threats
> > > identified for the MN/CN and only two for the
> MN/AR.
> > > This is perhaps understandable, given the
> attention
> > > the IETF security folks have been focussing on
> the
> BU
> > > security problem, but the MN/AR relationship is,
> in
> > > some sense, equally if not more important (it
> is,
> for
> > > example, a MUST and not a SHOULD).
> >
> > I'm not sure if 'AR' means 'Access Router', but
> assuming so..
> >
> > Hmm?
> >
> 
Yes.
> 
> > Am I mistaken but from the draft:
> > --8<--
> >    The goal is to determine which of those threats
> are of concern and
> >    should be defended against.  While the basic
> goal
> is "no worse than
> >    IPv4," the prevalence of wireless and the
> likely
> deployment of MIPv6
> >    in that space means the basic goal should aim
> at
> being "no worse than
> >    IPv4 with switched Ethernets", although the
> intent is not to try to
> >    solve the security problems of shared/broadcast
> wireless mediums.
> >    The threat model is used to generate a list of
> requirements to make
> >    the MIPv6 protocol secure against likely
> threats.
> These requirements,
> >    interspersed with the threats and also listed
> at
> the end of this
> >    document are aimed at providing guidelines in
> developing a solution
> >    for MIPv6 security.
> > --8<--
> >
> > Based on this:
> >
> > > 1) A malicious AR could hijack traffic from a
> trusting
> > > MN. This was partially identified in the
> document.
> >
> > This is no different from any secure IPv4/6
> environment.  If you don't use
> > AH/ESP or equivalent, any upstream router can do
> that.  This is not in the
> > scope of MIPv6, I think.
> >
> > > 2) A theaving MN could gain network access
> without
> > > authorization by soliciting a Router Advert,
> then
> > > setting up a CoA.
> > >
> > > 3) Similar to 2), a theaving MN could gain
> network
> > > access without authorization through responding
> to
> an
> > > unsolicited Router Advert, then setting up a
> CoA.
> >
> > This is no different from IPv6; it doesn't provide
> access controls on who
> > can or can not autoconfigure an address and use
> it.
> >
> > One should assume that if you can phycially get
> into
> a LAN, WLAN, a cell,
> > ... or whatever, you're authorized to use the
> network.
> >
> > So these may also be outside of the scope.
> >
> 
I agree that these will be threats in a wired
network
as well. The problem is that mobility can make them
worse because a mobile host can move quickly into an
out of a subnet without actually gaining physical
access to wired port. It is much easier to control
security when physical access is required (locked
doors, guards, etc.).

While in general I think it is a good tactic to
limit
the scope of Internet Drafts, in this case, we need
some kind of vehicle for identifying these threats
and
taking them to the right WG (IPNG? URP, should it
become a WG?). These security holes exist with IPv6
now, and even if we come up with the perfect
solution
to the BU security problem, if no other working
group
addresses them, MIPv6 will still not be secure, and
thus not deployable, IMHO.
> 
> >
> >
> > One _could_ list a few "known" issues in the
> draft,
> of course.  (About
> > one-two lines per non-issue).
> >
> 
Yes, I think this would be appropriate. There need
not
be a comprehensive discussion, just a place where we
can say "go look at RFC XYZ for a list of issues
that
already exist in IPv6 which become worse with
mobility." Unless, of course, some other WG has
already collected a list of these issues and all we
need to do is point to their draft?

                jak

__________________________________________________
Do You Yahoo!?
Make a great connection at Yahoo! Personals.
http://personals.yahoo.com