Subject: Re: identifiers and security

From: marcelo bagnulo braun <[email-masked]>
Date: Thu, 1 Jul 2004 11:24:05 +0200

>> I think if the redirection problem by attackers that are on-path
>> temporarily is limited to individual unprotected sessions, we are not
>> materially worse off than today as the same attacker could break the
>> sessions today also, and redirecting an unprotected session presumably
>> isn't worse than breaking it as the contents aren't secret.
>
> I think there is a difference between
>  - someone breaking into to office looking at the pieces of paper on
>    my desk
>  - someone breaking into my office and installing a device which allows
>    them to look at all future pieces of paper I will place on my desk
>
> Thus there is a difference between looking at unprotected communication
> while being on the path, and looking at unprotected communication
> long after having left the path.
> But this might be a case where we can make things be slightly worse 
> than
> in today's Internet since this communication was unprotected in any 
> case.
>

I am not sure how slightly this is...

suppose a host A with Locator LA
A server B with locator LB
and an attacker X with locator LX

A usually connects to B to get some information, for instance the news.

Now, X manages to be on the path between A and B for a while.
Now, X starts a communication with A and pretends to be B, and X 
creates a state in A mapping the identifier of A with locator LX.
Note that it can do that because the verification will be based on the 
RR and X will succeed because he is on the path.
Then, X leaves the place and goes to somewhere more comfortable for him

Now, in the future when A tries to reach B he will contacting X... 
forever ;-)

I don't feel that this would be acceptable

Regards, marcelo

>   Erik

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 1 Jul 2004 12:15:40 -0700 (PDT)

> I don't feel that this would be acceptable

I agree at some level, because this was the conservative approach that
was taken in the MIPv6 security design.

But one can argue against that by:
 - if the attacker was on the path, why couldn't the attacker leave a small
   device (running on a battery for a month for instance) attached?

  Erik

---

From: marcelo bagnulo braun <[email-masked]>
Date: Fri, 2 Jul 2004 12:57:37 +0200

>    device (running on a battery for a month for instance) attached?

:-)

i would argue that the attacker is still on the path (so you can do 
this in single homed internet), and this is not a time shifted attack, 
but i see your point.

regards, marcelo