Subject: (ngtrans) draft-soliman-siit-dstm-00.txt

From: "" <[email-masked]>
Date: Wed, 02 Aug 2000 18:36:23 PDT

Hesham/Erik,

I was talking to Hesham Soliman today so I know the draft (as 99% of all 
drafts :-) was done last minute before the I-D dead line so some things like 
Security Consideration did not get done.
Anyway here are some comments from a first pass on the draft.

For your security section
DOS Attacks
The DELTA update mechanism introduces a DoS attack problem which is very 
similar to the one that NAT-PT has and I am sorry to say a bit worse, not 
much though:). I explain; When an IPv4 only node tries to communicate with 
your IPv6 only nodes, it sends a DNS query for that node and DSTM mechanisms 
are used to reserve and map an IPv4 address to the IPv6 address of that 
node. The mapped IPv4 address is then returned to the IPv4 only node and can 
be used to initiate communications.
According to your draft this mapping is then have to also be broadcasted to 
all the SIIT translators of the site so that wherever the incoming IPv4 
packets come from, the SIIT box on that path will be able to translate to 
the correct IPv6 address.
As in NAT-PT incoming connection, an attacker can just send DNS queries for 
different IPv6 only nodes, which will result in starving of the DSTM server 
from IPv4 addresses. The part that is worse than NAT-PT is that you also 
have to send this information to the SIIT servers, creating some signaling 
overheads on the networka and state on the servers which might be important 
if you have a large number of SIIT boxes. Of course you need to also timeout 
this state timely but  I guess this is implementation detail.

A more general comment
In this draft it seams the aim is to support mobile nodes with mobile IPv6 
only stack and mobile IPv6 support so, translation is used for IPv4 
communications, which is a bot of a shame...
I think that it should be possible to make a DualStack IPv4 and IPv6 node 
work using DSTM and Mobile IPv6 signaling, without need for translation. I 
will try to put in a draft some ideas I have on that as soon as I get a 
chance...

Good work
George

*
This is George not having access to his proper e-mail
*
George Tsirtsis
Internet Transport Research
Adastral Park
BT
Proper e-mail: [email-masked]
*
Notice: This contribution is the personal view of the
author and does not necessarily reflect the technical nor
commercial direction of British Telecommunications plc.

________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com