Subject: Re: [mobile-ip] Security Requirements Draft

From: Francis Dupont <[email-masked]>
Date: Mon, 01 Oct 2001 17:11:21 +0200

I would like to float another proposed assumption and get feedback on this.
   
   3> That there is some sort of SA (perhaps dynamically created at initial
   access) between the ARs and the MN in the visited subnet.
   
=> I don't think this is a good idea because :
 - this is hard in some cases to get this SA
 - mobile IPv6 draft has "access control for visited networks" in non-goals.

But of course the existence (or not) of this SA is important for
some threats, so my concern is only about an assumption.

Regards

[email-masked]

PS: about the other "drop everything (:-)" thread: I disagree the only
simple solution is to drop everything but I'd like to see the
anti-optimized/reverse-tunneling solution in mobile IPv6 document
because this is both simple and very secure.

---

From: "Charles E. Perkins" <[email-masked]>
Date: Mon, 01 Oct 2001 08:36:39 -0700

Hello Francis,

Your solution is already supposed to be "in there", because the
home agent is required to be able to decapsulated packets from
the mobile node.  If this point has somehow been lost since the
time I was originally editing the document, I will make sure that
it gets restored to the text.  Thus, I don't think there is anything
to be done, unless you would like to have an appendix that points
out explicitly that home agent decapsulation is valuable for use
with mobile nodes that don't wish to use the Home Address destination
option.

Also, I would like to point out that the Home Address destination
option was designed NOT to be a threat to ingress filtering, because
the home address of the sender is right there!  Putting your true
address into the packet is a very bad way to hide.  If the worry
has something to do about using the care-of address, then it has
nothing to do with Mobile IPv6 anyway, because any node can
autoconfigure a topologically correct address that would look
indistinguishable from the mobile node's use of such a topologically
correct address.

Regards,
Charlie P.

---

From: Francis Dupont <[email-masked]>
Date: Tue, 02 Oct 2001 11:11:49 +0200

the mobile node.

=> all parts of the mechanism are there but not the whole picture.

   Thus, I don't think there is anything
   to be done, unless you would like to have an appendix that points
   out explicitly that home agent decapsulation is valuable for use
   with mobile nodes that don't wish to use the Home Address destination
   option.
   
=> something which clearly explains how to do the "anti-optimized"
mode should be really useful. I like this idea of an appendix.

   Also, I would like to point out that the Home Address destination
   option was designed NOT to be a threat to ingress filtering, because
   the home address of the sender is right there!

=> this is true for firewalls which provide tyhe ingress filtering
(i.e. they can be smart enough :-) but not for attacks like DDoS
(attacks that ingress fileting is the defense against).

Thanks

---

From: "Charles E. Perkins" <[email-masked]>
Date: Tue, 02 Oct 2001 08:21:58 -0700

> mode should be really useful. I like this idea of an appendix.

Text is always appreciated.  In this case, since you have thought about
the idea more than I have, I can imagine that you might be able to provide
the basic text.

> (attacks that ingress fileting is the defense against).

I don't think there is a significant exposure here, but maybe you can
clear it up for me in e-mail off the list.  

Reverse tunneling is probably useful for privacy, but I don't think it
is any better than the Home Address destination option for limiting
the kind of problem you are concerned about.

Regards,
Charlie P.