[Mip6] review of draft-dupont-mipv6-3bombing-00.txt

Hi Francis,

And thanks for writing this draft. I think we need it.

I pretty much agree with all that you say in the draft. I think
prohibiting alternate care-of address option is a good idea,
and it should be studied further.

I'd like to expand a little bit on what you say in under
2.3 regarding route optimization.

As you have pointed out, anyone can spoof the source address
of a TCP SYN packet, so we generally can not worry too much
single request - single response attacks. Except where mechanisms
to defeat ingress filtering are provided, which you also mention.

As Christian pointed out in his e-mail explaining the security
background for early binding updates, and is also discussed in
Section 2.5 of [1], we also need to consider the possible
amplification factor. The problem with bombing attacks in the
RO case is using first a right address, getting to see TLP sequence
numbers so that fake acks can be sent, and then moving
the stream to the victim's address. This can be devastating,
at least under some conditions. The difference to a regular
TCP SYN spoofing is that you actually get to see some
inital part of the traffic, which may make things easier
for the attacker. Having said this, [1] notes that different
TLPs and different TCP implementations behave in different
ways regarding this attack. It might be useful to shed
some further light on this, to figure out exactly how
serious (or not) this attack is.

There is a related issue that has to do with the level
of ingress filtering support in the Internet. We have
more or less accepted the situation where this support
is not universal. So, we can assume that we can be targets
of e.g. spoofed TCP SYNs or reflected packets. I would
not like to make this any worse by making it possible to
be a victim of a stream of packets.

Comments?

--Jari

[1] http://www.arkko.com/publications/draft-aura-mipv6-bu-attacks-01.txt

_______________________________________________
Mip6 mailing list
Mip6@ietf.org
https://www.ietf.org/mailman/listinfo/mip6