Re: [Mip6] Review of draft-irtf-mobopts-ro-enhancements-00.txt

[Francis Dupont <[e-mail]>]

 In your previous mail you wrote:

=> I agree with your main comment, for instance the security of RR
was already well analyzed and should not be reproduced in the document.
   
   Section 2.0: I believe Pekka Nikander has a MIP6 WG draft
   (draft-ietf-mip6-ro-sec-02.txt) that discusses many of the issues that are
   discussed in this and subsequent sections. This draft should be referenced
   somewhere here.
   
=> the example itself (:-).

   Section 2.3, 2nd last para: I was looking here for the standard "ingress
   filtering will handle redirection-based DoS attacks" here, and the
   refutation of why that isn't practical. It might be useful to put in a
   forward reference, since it is dealt with later in the paper.
   
=> note that my argument about the ingress filtering is not this one.

   Section 3.2, end of 1st para: The impact on the core Internet of
   bidirectional tunneling is actually quite minimal given the amount of dark
   fiber left over from the Boom. It has been estimated that less that 10% of
   the cross-continent fiber in North America is lit, and the number is
   probably similar for intercontinental and other long distance links in other
   countries.

=> soem kind of "the Internet is ultra-metric" argument?
(d(A,B) + d(B,C) = d(A,C))
   
   Section 3.2, 6th para: This paragraph misses the issue of CRL checks. These
   could be a significant issue when using certificates for route optimization
   security.
   
=> note the CRL check issue is a property of some PKIs, including X.509
as it should be used...

   Section 3.2, 9th para: In my mind, the primary argument against depending on
   ingress filtering is that there is no incentive - financial, regulatory, or
   legal - for ISPs to deploy it.

=> as you said after this is true for any global Internet security device.

   A diligent ISP will of course do so, but a
   corrupt ISP might even have a financial incentive to not deploy it, if
   redirection-based DoS attacks using route optimization ever become possible
   and are exploited for financial gain. This has been an issue with spam, for
   example. I think something to that effect needs to be said. While some
   people might be offended by this, the need for security in the Internet
   results from the fact that, lacking any incentives to the contrary, some
   people will do bad things if they can get away with it and it can result in
   financial gain. Most discussions of security ignore this basic fact of human
   nature, and treat the problem like solar physics or something.
   
=> I fully agree but your argument works only against the "ingress
filtering will save MIPv6" thesis, not against my "without ingress
filtering we have no defense against flooding attacks with or without
MIPv6". The current situation unfortunately supports mine with the
everyday DDoS attacks using "botnets", and if today the issue is for
IPv4, IPv6 is a worse case because the lack of support for ingress
filtering BCPs (with a plural because BCP84/RFC3704 is more critical
for the IPv6 way to support multi-homing).

   The argument you advance
   later in the paper that the attacker can still mount an attack on the subnet
   is irrelevent. An attacker can do that without using route optimization, by
   creating a zombie and programming it to iterate through non-existant
   addresses in the victim subnet.
   
=> note this is in fact an instance of my argument in favor of
the ingress filtering!

   Section 6.3.2: final, all-encompassing method -> widespread method
   Actually, I disagree with this conclusion. I think the current crop of
   limited applicability RO security protocols are likely to die from lack of
   implementation and interest and a next gen protocol, possibly including CGA
   and CBA, that is widely applicable and a big improvement on RR is likely to
   have more success.
   
=> I don't know: when I ask friends about their interest into RO deployment
(I control the implementation point :-), the two common concerns are the
lack of security of RR and the complexity of CN code. There are some
limited applicability ROs which answer to both but they have limited
applicability... I believe CGA or something equivalent (but without CBA
which gives nothing real in exchange of its extra complexity) is the
last chance of RO, but do we need RO?

   Section 6.3.2: One issue that I've never really seen dealt with is whether
   or not RO is really needed.

=> this is the question we should not ask because we are afraid of its
possible answer (:-).

   Nobody has measured this. Skype seems to get by
   with lots of indirect routes For example, our experiments show that when we
   make a Skype call from one node in our San Jose lab to another, it goes
   through a supernode in Europe, yet the quality of the call is fine.
   Everybody seems to be assuming this is a problem, but nobody seems to have
   set up a network and actually measured whether it is *really* a problem,
   with MOS scores, etc.
   
=> bi-tunneling has still good security properties: it can be made very
secure (encrypt everything) and provide location privacy. Perhaps we
should put our effort on the basic MIPv6/NEMO support. I believed there
was no good business cases for MIPv6, mainly because computers are not
designed to be mobile, and smaller devices worked better without IP.
But today I believe MIPv6 is better than depending in WLAN & co security:
 + unified framework
 + easy vertical handoff support
 + good performance on handoffs (.5 RTT vs re-auth nightmare)
 - no DoS protection but 802.11i for instance has none too...
has 3GPP2 already what I am thinking to?

Regards

[e-mail]

_______________________________________________
Mip6 mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/mip6