Subject: RE: DoS Attack and Information Gap in Dycard (was: Re: [Seamoby] Topic #1: Dos Attack)

From: [email-masked]
Date: Tue, 11 Mar 2003 12:41:58 -0500

> No it doesn't. Currently, FMIPv6 uses a global address for 
> pAR in only one way:
> the MN sends FBU to pAR to set up the tunnel. But providing 
> security for this
> has been a problem, and there is discussion in the MIP group 
> for the signaling
> to go to the current AR (whether pAR or nAR is immaterial) to 
> set up the tunnel.
> That way, SEND could be used to secure the signaling 
> (possibly with some
> authorization token to the pAR, that is still under 
> discussion) between the MN
> and AR, and the HI/HAck would be secured using the 
> interrouter security
> association.
> 
> With dycard, nAR needs pAR's address from the MN in order to 
> be able to send
> PNE. Dycard establishes a dependency on the global IP address 
> of the router
> being provided by the MN which may not be there in the end 
> for fast handover.
> 

[Govind] Can't any of the dycard messages from the AR to the MN can carry 
the global IP address of the AR to the MN as the source address 
of the packet. This can be protected by an existing AR-MN SA if needed. 

> This is one reason why I think the CARD work needs to be 
> moved into the MIP
> group (or, at least, the MN to AR part). Seamoby could end up 
> designing a
> protocol that doesn't provide what FMIP needs.

[Govind] I don't think this restriction is needed. I think CARD protocol
can provide input for FMIP  as well as other seamless handover
protocols. It is a generic protocol and it should remain as one. 
_______________________________________________
Seamoby mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/seamoby

---

From: [email-masked]
Date: Tue, 11 Mar 2003 12:41:58 -0500