Subject: Re: [mobile-ip] MIPv6 SecReqs: HA Dyn Discovery

From: Alexandru Petrescu <[email-masked]>
Date: 03 Oct 2001 22:29:26 +0200

Pekka Savola <[email-masked]> writes:
>  2) the assumption may be flawed in a scenario:
> 
>    1  The mobile node and the HA have setup a pre-established security
>       association before the mobile node begins to roam and connects to
>       the network from a location that is not its home.
> 
> This wouldn't appear to work with e.g. 'Dynamic Home Agent Address
> Discovery' (10.8), that is, e.g. when the trusted HA dies and MN is
> away from home and it needs to find the new HA.  The assumption is
> valid only after a HA-MN relationship has been formed.

I think H.1 is a threat _related_ to DHAAD.  One could probably add a
new threat B.x in which DHAAD itself is attacked.  Your description
seems to imply that an attacker close to MN would reply to a discovery
sent by MN to its home, giving fake HA addresses.

As an aside, the assumption SA MN-HA can be detailed such that the SA
MN-HA is betweeen an MN's Home Address and the "Mobile IPv6
Home-Agents" anycast address (and not between the Home Address and one
Home Agent Address).  In fact, it suffices to say:

     1  The mobile node and all its potential HA's at home (the home of
        the initial Home Address and not that of an intermediary CoA)
        have setup a pre-established security association before the
        mobile node begins to roam and connects to the network from a
        location that is not its home.

instead of:

     1  The mobile node and the HA have setup a pre-established security
        association before the mobile node begins to roam and connects to
        the network from a location that is not its home.

Alex

---

From: Michael Thomas <[email-masked]>
Date: Mon, 8 Oct 2001 09:44:44 -0700 (PDT)

Pekka Savola writes:
 > It appears to me that MIPv6 has gotten awfully "fat" with all of these
 > options, and may not be globally, securely workable in the end.  Would it
 > be better to consider simpler scenarios at first, e.g.
 > 
 >  1) MN's would send BU's to CN's first-hop routers (e.g. subnet-router
 > anycast address); this might scale better especially if IPv6 end-nodes are
 > supposed to be simple.

Pekka, 

I think this is an interesting idea generally,
and have been thinking along the same lines.

A couple of observations and questions:

1) The ideal place to update the route is at
   the join point between the HA, MN and CN,
   which is not necessarily CN's first hop
   router

2) Would this scale (even if it were at CN's
   first hop router)

3) Could it be secured? Ie, does this introduce
   new vulnerabilities, or exacerbate old ones?

4) How do you know the subnet prefix so that you
   can create the anycast address?
 
Until these sorts of things are fleshed out,
I'm pretty sure that the WG is going to keep
the bird in hand, so to speak.

	 Mike