Subject: [mobile-ip] Replay attack in BAKE

From: Alexandru Petrescu <[email-masked]>
Date: 04 Oct 2001 13:03:24 +0200

Hi,

I think that in the context of BAKE, MN-initiated operation, it is
possible for an attacker to replay a set of BW and BKE to a CN.  For
example, an attacker on the MN's link listens to the BW/BKE sent to a
CN and once that MN's traffic stops (presumably MN moved), the
attacker would replay the same BW/BKE pair to the respective CN.  This
would fool the CN to believe that MN moved back to the place where
attacker is.

I think the success of this attack relies on the "freshness" of K_CN,
which is a fixed constant (moreover, a history is kept).

It also relies on the fact that CN doesn't check a history of received
N1's (since it doesn't keep state).

I probably have missed something when trying to understand BAKE, but
I'm doing my best.

Alex