Subject: Problem of interaction between SEND(CGA) and the IPv6 mobility

From: "Jean-Michel COMBES" <[email-masked]>
Date: Mon, 28 Jun 2004 13:20:18 +0200

Hi,

IMO, it would be necessary to add a warning in the Security Considerations
section regarding the interaction between SEND(CGA) and the IPv6 mobility
protocols. 

*** Problem ***

This problem concerns the following IPv6 mobility protocols:
- MIPv6 [3]
- HMIPv6 [4]
- FMIPv6 [5]
- NEMO [6]

For each of these protocols, the "mobility manager" (HA for MIPv6 and NEMO,
MAP for HMIPv6, PAR for FMIPv6) may have to intercept the packets for the
Mobile to tunnel them to its real location. 

To do such a thing, the "mobile manager" uses NDP.
As example, from RFC 3775:
"In order to do this, when a node begins serving as the home agent it MUST
multicast onto the home link a Neighbor Advertisement message [12] on behalf
of the mobile node.  For the home address specified in the Binding Update,
the home agent sends a Neighbor Advertisement message [12] to the all-nodes
multicast address on the home link, to advertise the home agent's own
link-layer address for this IP address on behalf of the mobile node.  If the
Link-Layer Address Compatibility (L) flag has been specified in the Binding
Update, the home agent MUST do the same for the link-local address of the
mobile node."

The others IPv6 mobility protocols use exactly the same mechanism.

(This mechanism is not clear in FMIPv6 but it is pretty sure this is the
same mechanism)

So, if SEND(CGA) is used, the "mobility manager" MUST have the private key
(associated to the public key used to generated the CGA address) used by the
Mobile to sign its ND packets.

*** References ***

[1] draft-ietf-send-ndopt-05.txt, "SEcure Neighbor Discovery (SEND)", J.
Arkko (Editor)/J. Kempf/B. Sommerfeld/B. Zill/P. Nikander, April 2004
[2] draft-ietf-send-cga-06, "Cryptographically Generated Addresses (CGA)",
T. Aura, April 2004
[3] RFC 3775, "Mobility Support in IPv6", D. Johnson/C. Perkins/J. Arkko,
June 2004
[4] draft-ietf-mipshop-hmipv6-02.txt, "Hierarchical Mobile IPv6 mobility
management (HMIPv6)", H. Soliman/C. Catelluccia/K. El Malki/L.Bellier, June
2004
[5] draft-ietf-mipshop-fast-mipv6-01.txt, "Fast Handovers for Mobile IPv6",
R. Koodli (Editor), January 2004
[6] draft-ietf-nemo-basic-support-03.txt, "Network Mobility (NEMO) Basic
Support Protocol", V. Devarapalli/R. Wakikawa/A. Petrescu/P. Thubert, June
2004

Regards.

JMC.

France Telecom - R&D Division - MAPS/NSS   
Jean-Michel COMBES, Internet/Intranet Security
E-Mail: [email-masked]
Phone: +33 (0)1 45 29 45 94
Fax: +33 (0)1 45 29 65 19
Mobile: +33 (0)6 07 29 30 16 

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------