Subject: RE: [mobile-ip] Requirements for non-MIPv6 implementations [MIPv6 - Focus of thesecurity discussion]

From: "Glenn Morrow" <[email-masked]>
Date: Thu, 11 Oct 2001 14:52:04 -0500

Clarification:

What I referred to below as DDOS redirection or bouncing is actually
referred to in the security requirements draft as "packet reflector"
-(Section 6.8: Threat H.3 and Scenario H.3. Sorry about the discontinuity in
terminology.

-----Original Message-----

Charlie and Pekka, 
In relation to changing the BU processing to a MUST from a SHOULD for CN's: 

It just seems to me that some protection needs to be done even for the HA
option to prevent against DDOS redirect (bouncing) and that the solutions
that seem tenable (don't require that every packet is  authenticated)
require some sort of authorization and state table similar to a binding
cache in size, lookup structure etc.. 
So if the HA option is a MUST and we have to protect against this DOS
redirect (bounce) problem then it seems like you might as well go ahead and
make the binding update processing a MUST too and get the ubiquity of route
optimization for IPv6. The HA integrity appears to me to be almost the same
class of problem and solution set as the BU integrity.
Thanks, 
Glenn

---

From: "Glenn Morrow" <[email-masked]>
Date: Fri, 12 Oct 2001 09:01:41 -0500

And even more clarification:

http://www.ietf.org/internet-drafts/draft-savola-ipv6-rh-ha-security-00.txt

-----Original Message-----

Clarification: 
-----Original Message----- 
Charlie and Pekka,