Re: Last Call: IP Mobility Support to Proposed Standard

[Dave Johnson <[e-mail]>]

>I oppose the advancement of these protocols to Proposed Standard, on
>both technical and process issues.
>
>This missive covers a few of the technical issues for
>
>>  1. IP Mobility Support
>> 	<draft-ietf-mobileip-protocol-15.txt>
 ...
>                                ----
>
>The use of "nonces" is a poor design option, and should be removed
>(again).
>
>The only purpose for the nonces is to protect against an attacker that
>can intercept and replace all traffic to and from the Foreign Agent.
>Note that this requires more than just a "tap" at both places, but also
>the ability to modify messages and retransmit:
>
>
>                     HA ====>X====>FA====>X====> MN
>
>This attack is so utterly improbably in a mobile network as to be
>ludicrous.  The attack would become impossible if IP Security were used,
>which would also remove one of the potential patent problems.

Bill,

You are incorrect on the attack we are trying to prevent with the
use of nonces.  In fact, the use of nonces solves the same problem
(in a different way) as our use of timestamps.  We cannot allow an
attacker to replay an old Registration Request to a mobile node's
home agent.  Otherwise, the attacker could change the binding 
registered for the mobile node, causing the mobile node's packets
to be sent to where the mobile node was possibly long ago.  To
exploit this attack, the attacker need only capture an authenticated
Registration Request, and may then replay it any time later. To
keep from having the mobile node detect the attack (by seeing an
extra Registration Reply), it would help the attacker to also be
able to block this single reply packet, but this is not too hard
(and may not be required, since the mobile node may not notice the
extra Registration Reply, or the extra Reply might simply be
lost by the network).  There is no requirement in this attack to
"intercept and replace all traffic to and from the Foreign Agent",
nor does this attack require "the ability to modify messages".

In addition, since we can't use IP Security for the Mobile-Home
Authentication, this attack cannot be made "impossible" by the use of
IP Security.  When a mobile node registers with its home agent, the only
authentication needed is a Mobile-Home Authentication extension.
The attack proceeds by replaying this Registration Request message at
a later time to the home agent.

					Dave