RE: [Mipshop] Re: How probable is compromise of an AR? (was: Re: SEND-based protection and related confusions )

Lakshminath,

>After having read the latest in this thread, let me summarize my take 
>on this to avoid misunderstandings.
>
>First, if an entity that is party to a protocol is compromised, we 
>have a difficult problem to solve.  (James, you seem to be thinking 
>this is the problem we are talking about, but that's not so; please 
>read on).  

=> This is your own summary of your own comments. RFC 4140 does not 
mention anything in the security considerations about node compromise 
nor if the related problem is easy or difficult nor if it needs to be 
solved or not.

In *summary* to your summary, your comments are misleading.

>We then go on to think about the impact of AR compromise; 
>for instance, would it possible that compromise of an AR might impact 
>MNs that are not using that AR?  If so, we should try and mitigate that, etc.

=> First, you should back your comments with clear ways to mount such 
attack (other than physical compromise). I can also think about many 
ways to compromise the MAP which is much more interesting for an attacker 
(using means equal to physical compromise) than compromosing an AR during 
one particular interval of time in order to attack the draft that you are 
trying to attack. 

FYI, the operators infrastructures are not open for visitors nor tourists.
(I've personally been involved in deployment in a third world country and
saw how much securing the nodes themselves is critical). 

>However, we are not talking about that here.  HMIP BUs go from the MN 
>to the MAP.  An AR is not a party to this communication 
>(sending/receiving BUs/BAcks).  

=> and in the draft he is not involved in sending/receiving the BU/BA other
than routing.

>I'd then apply the "Internet threat" model to the path in between the MN 
>and the MAP.  

=> The threat analyze for HMIPv6 is well described in RFC4140 and it did
not mention an AR compromise. I think you should ask the authors why such
threat has not been mentioned especially that the AR in HMIPv6 intervenes 
in delivering MAP(s) information to the MNs.

>As long as there is a path between the MN and the MAP, HMIP should work.

=> sure. Add to this: "with only one AR working in the whole MAP domain"... 
which of course makes mobility even more attractive! :)

Wassim H.

_______________________________________________
Mipshop mailing list
Mipshop@ietf.org
https://www1.ietf.org/mailman/listinfo/mipshop