Subject: (ngtrans) Security and use of SIIT and NAT-PT [IPv4 and MIPv6 Transition]

From: Pekka Savola <[email-masked]>
Date: Thu, 25 Oct 2001 15:52:46 +0300 (EEST)

I'll post this primary on ngtrans.  If there are further comments I think 
mobile-ip can be safely removed.

On Thu, 25 Oct 2001, Hesham Soliman (EPA) wrote:
> > Perhaps I shouldn't comment on this, but anyway...
> > 
> 	=> Why not !

Partly ideological debate, better held in ngtrans anyway :-)
 
> > > There is another draft you can find at:
> > > http://standards.ericsson.net/hesham/draft-ietf-ngtrans-siit-dstm-00.txt
> > > 
> > > It's a WG draft in NGTRANS but it expired and I'll
> > > resubmit it after adding some of the comments received. 
> > 
> > SIIT is regarded by many to be an abomination (redefining internal 
> > structure like mapped-addresses) from security point-of-view among others.
> > 
> > It can probably solve some problems efficiently though, or else it 
> > wouldn't have been introduced. :-)
> > 
> 	=> Well SIIT is a translation algorithm, used by NAT-PT and
> 	this draft. It certainly does solve problems, like translating
> 	packets.

There is a significant difference with SIIT and NAT-PT algorithm.  NAT-PT
does not use mapped addresses when signifying an IPv4 node.

Putting mapped addresses as source/destination addresses is evil; think of
(ab)using these against dual-stacked nodes. 

E.g.: IPv4 firewall would block packets from source 1.2.3.4, but the
packet gets through via IPv6 transport with src address ::ffff:1.2.3.4,
and the destination will falsely believe that it originated from IPv4
source 1.2.3.4.

This would open some new IPv6 <-> IPv4 reflector attacks, too, I believe.
 
> > But it should be kept in mind that it, alone, cannot be relied on to be
> > sufficient for (M)IPv4 -> (M)IPv6 transition.
> > 
> 	=> Can you elaborate a bit ? This draft is done for allowing
> 	IPv4-only nodes to communicate with IPv6-only nodes. 
> 	MIP is one aspect of this communication. 
> 	The draft doesn't say that this is the only way to do it, 
> 	although in fact, for this scenario, it is the only way I know
> 	of that allows for mobility support. 

Perhaps I didn't say it clearly; _IMO_, SIIT is not fit to be a
wide-spread translation mechanism for IPv6-only nodes.  NAT-PT seems much
better.  I tried to avoid getting MIP mixed into this.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords