Subject: RE: [mobile-ip] Requirements for non-MIPv6 implementations [MIPv6 - Focus of thesecurity discussion]

From: "Glenn Morrow" <[email-masked]>
Date: Thu, 11 Oct 2001 10:48:15 -0500

Charlie and Pekka,

In relation to changing the BU processing to a MUST from a SHOULD for CN's:

It just seems to me that some protection needs to be done even for the HA
option to prevent against DDOS redirect (bouncing) and that the solutions
that seem tenable (don't require that every packet is  authenticated)
require some sort of authorization and state table similar to a binding
cache in size, lookup structure etc.. 

So if the HA option is a MUST and we have to protect against this DOS
redirect (bounce) problem then it seems like you might as well go ahead and
make the binding update processing a MUST too and get the ubiquity of route
optimization for IPv6. The HA integrity appears to me to be almost the same
class of problem and solution set as the BU integrity.

Thanks,

Glenn

---

From: Francis Dupont <[email-masked]>
Date: Fri, 19 Oct 2001 18:37:01 +0200

=> to try to force one's hand is a last chance solution (i.e. in general
not a solution at all :-).

[email-masked]