Re: Flooding Attacks and MIP6 (was RE: [Mipshop] Review of draft-arkko-mipshop-cga-cba-04)

Jari Arkko wrote:

>> 3. Using MIP6 home subscription to redirect traffic to the victim. Of
>> course, the risk here is that of authenticated nodes registering the
>> victim's IP address as its CoA. 

> Let me first state that if I could redesign RFC 3775 today, I would probably
> NOT include an administrative security association relationship for the
> MN - HA. This would have made deployment much easier (e.g. DHCP
> assigned home agents without any of the bootstrapping complexity).
> And it would have gotten us rid of problem #3.

we could add a return routability check for the home agent
to check if the mobile node is at the CoA it is claiming in
the BU. but AFAIK, it has not been seen as an issue so far.

regarding the "administrative security association
relationship", things are no longer so rigid (RFC 3775 ties
an SA to the home address) with the bootstrapping specs. the
mobile node can be assigned any random home agent as long as
there is a way to authenticate each other.

Vijay

_______________________________________________
Mipshop mailing list
Mipshop@ietf.org
https://www1.ietf.org/mailman/listinfo/mipshop