Re: [Mip6] WGLC: draft-ietf-mip6-bootstrapping-split-01 - Comments

[Vijay Devarapalli <[e-mail]>]

Francis Dupont wrote:
>  In your previous mail you wrote:
> 
>    it was done this way to require minimal changes to RFC 3775 and
>    the IKEv2 implementation on the HA. an IPsec implementation
>    typically does not perform proxy DAD when allocating an address
>    and returning it in the CFG_REPLY message.
>    
> => IMHO an IKEv2 implementation should perform a proxy DAD when it
> allocates an address before returning it as it should provide
> a proxy NDP service (i.e., reply to NS by not-overriding NA).
> Both should be configurable with by default being on.

okay, but I dont think we should mandate the IKEv2 implementation
to do proxy DAD.

>    the authorization check is required. cant be skipped.
> 
> => show us where this authorization for the address is required
> or even mentioned in RFC 2136, PLEASE!

in the security considerations section we have the following.

    This
    choice was motivated by a concern for preventing redirection-based
    flooding attacks (see draft-ietf-mip6-ro-sec [19] for more
    information about redirection-based flooding attacks and the role
    preventing them played in the design of Mobile IPv6 route
    optimization security). Exactly as for route optimization, it is
    possible for a node that is the legitimate owner of a DNS FQDN -
    in the sense that it has a security association with the DNS
    server allowing it to perform dynamic DNS update of its FQDN - to
    bind its FQDN to the address of a victim, then redirect large
    volumes of traffic at the victim. The attack may be propagated
    without the owner's knowledge, for example, if the node is
    compromised by malware, or it may be intentional if the node
    itself is the attacker.

if RFC 2136 ignored this, I cant help it.

Vijay


_______________________________________________
Mip6 mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/mip6