Re: [Mip4] WGLC Comments: draft-ietf-mip4-mobike-connectivity-01.txt

Sami Vaarala wrote:
> Narayanan, Vidya wrote:
>>  
>>
>>> -----Original Message-----
>>> From: Vijay Devarapalli [mailto:vijay.devarapalli@AzaireNet.com] 
>>> Sent: Friday, December 15, 2006 8:03 AM
>>> To: Narayanan, Vidya
>>> Cc: Sami Vaarala; Mobile IPv4 Mailing List; Henrik Levkowetz
>>> Subject: Re: [Mip4] WGLC Comments: 
>>> draft-ietf-mip4-mobike-connectivity-01.txt
>>>
>>> Sami, Vidya,
>>>
>>> I am not convinced that there is anything special here. Any protocol 
>>> that uses a hash function to generate a MAC is susceptible to brute 
>>> force attacks.
>>>
>>
>> Well, it is the same thing as the IP address and NAI - if the
>> registrations were only limited to be inside the trusted network, this
>> would not have been available to an attacker in the untrusted network.
>> I don't feel strongly about having this text though. I see Sami's point
>> and agree with that, but, if you don't include the text on brute force
>> attacks, that's fine with me. 
> 
> Right, I also think this attack is rather obvious.  I just think that
> if we mention that the i-HA address can be easily seen from the RRQ,
> many other attacks are also possible: they are all part of the same
> "problem".  So I'd prefer that we either (a) don't mention this at all
> (because it's fairly obvious), or (b) mention that there are several
> vulnerabilities related to the attacker seeing the inner MIP RRQ,
> including address/NAI leakage and brute force attacks.
> 
> Either way (with or without a security considerations issue) works
> for me.  I don't think the clarification is necessary, but it doesn't
> do any harm either.

Here is some new text

    When the mobile node sends a registration request to the i-HA from an
    untrusted network that does not go through the IPsec tunnel, it may
    be leaking the i-HA's address, its own identity including the NAI and
    the home address, and the Authenticator value in the authentication
    extensions to the untrusted network.  This may be a concern in some
    deployments.

Vijay

-- 
Mip4 mailing list: Mip4@ietf.org
    Web interface: https://www1.ietf.org/mailman/listinfo/mip4
     Charter page: http://www.ietf.org/html.charters/mip4-charter.html
Supplemental site: http://www.mip4.org/