Subject: [secdir] Secdir review of draft-ietf-mext-flow-binding-06

From: Tina TSOU <[email-masked]>
Date: Wed, 05 May 2010 17:05:45 +0800

Hi,
I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

Some of my comments are following.

Comment 1:
The title of this document focuses on flow binding in Mobile IPv6 and NEMO, However it is not clear how flow binding is supported in the NEMO? Is the mobile router operation in NEMO same as mobile node operation in Mobile IPv6?

Comment 2:
Is flow summary mobility option is one sub-option of Flow Identification Mobility Option or one independent new mobility option? 

Comment 3:
Should the HA, CN and MAP all support this specification? If HA does not support, how to direct inbound flows to specific addresses since one or more flows may bind to a care-of address?

B. R.
Tina
http://tinatsou.weebly.com/contact.html

---

From: Tina TSOU <[email-masked]>
Date: Wed, 05 May 2010 17:45:21 +0800

Resending to the correct email addresses of the authors...

  ----- Original Message ----- 
  From: Tina TSOU 
  To: [email-masked] 
  Cc: [email-masked] ; [email-masked] 
  Sent: Wednesday, May 05, 2010 5:05 PM
  Subject: Secdir review of draft-ietf-mext-flow-binding-06

  Hi,

  Comment 1:

  Comment 2:

  Comment 3:

  B. R.
  Tina

---

From: Tina TSOU <[email-masked]>
Date: Thu, 06 May 2010 10:00:39 +0800

The Security Considerations section must at least point to an RFC in which the 
relevant security analysis for binding updates and acknowledgements is documented.

The authors may consider adding the following text:

"This specification does not open up new fundamental lines of attack on 
communications between the MN and its correspondent nodes. However, it allows 
attacks of a finer granularity than those on the basic binding update. For 
instance, the attacker can divert or replicate flows of special interest to the 
attacker to an address of the attacker's choosing, if the attacker is able to 
impersonate the MN or modify a binding update sent by the MN. Hence it becomes 
doubly critical that authentication and integrity services are applied to 
binding updates."

B. R.
Tina

    ----- Original Message ----- 
    From: Tina TSOU 
    To: [email-masked] 
    Cc: [email-masked] ; [email-masked] 
    Sent: Wednesday, May 05, 2010 5:05 PM
    Subject: Secdir review of draft-ietf-mext-flow-binding-06

    Hi,

    Comment 1:

    Comment 2:

    Comment 3:

    B. R.
    Tina