Re: [secdir] Secdir review of draft-ietf-mext-flow-binding-06

[Tina TSOU <[e-mail]>]

The Security Considerations section must at least point to an RFC in which the 
relevant security analysis for binding updates and acknowledgements is documented.

The authors may consider adding the following text:

"This specification does not open up new fundamental lines of attack on 
communications between the MN and its correspondent nodes. However, it allows 
attacks of a finer granularity than those on the basic binding update. For 
instance, the attacker can divert or replicate flows of special interest to the 
attacker to an address of the attacker's choosing, if the attacker is able to 
impersonate the MN or modify a binding update sent by the MN. Hence it becomes 
doubly critical that authentication and integrity services are applied to 
binding updates."


B. R.
Tina
http://tinatsou.weebly.com/contact.html
  ----- Original Message ----- 
  From: Tina TSOU 
  To: [e-mail] ; [e-mail] 
  Cc: [e-mail] 
  Sent: Wednesday, May 05, 2010 5:45 PM
  Subject: Re: Secdir review of draft-ietf-mext-flow-binding-06


  Resending to the correct email addresses of the authors...

    ----- Original Message ----- 
    From: Tina TSOU 
    To: [e-mail] 
    Cc: [e-mail] ; [e-mail] 
    Sent: Wednesday, May 05, 2010 5:05 PM
    Subject: Secdir review of draft-ietf-mext-flow-binding-06


    Hi,
    I have reviewed this document as part of the security directorate's ongoing
    effort to review all IETF documents being processed by the IESG.  These
    comments were written primarily for the benefit of the security area
    directors.  Document editors and WG chairs should treat these comments just
    like any other last call comments.

    Some of my comments are following.

    Comment 1:
    The title of this document focuses on flow binding in Mobile IPv6 and NEMO, However it is not clear how flow binding is supported in the NEMO? Is the mobile router operation in NEMO same as mobile node operation in Mobile IPv6?

    Comment 2:
    Is flow summary mobility option is one sub-option of Flow Identification Mobility Option or one independent new mobility option? 

    Comment 3:
    Should the HA, CN and MAP all support this specification? If HA does not support, how to direct inbound flows to specific addresses since one or more flows may bind to a care-of address?



    B. R.
    Tina
    http://tinatsou.weebly.com/contact.html