[MEXT] [RFC3775 changes] Closure on on "Use of DHAAD mechanism"

[Julien Laganier <julien.IETF at laposte.net>]

Folks,

We really need to conclude this discussion. So far 75 (seventy-five!) 
messages have been exchanged on the topic. The new text is supported by 
Georges and JMC, while Alex and Vijay disagree.

What do other people on the list think?

--julien

------------------------------------------------------------------------
OLD:

15.5.  Dynamic Home Agent Address Discovery

   The dynamic home agent address discovery function could be used to
   learn the addresses of home agents in the home network.

   The ability to learn addresses of nodes may be useful to attackers
   because brute-force scanning of the address space is not practical
   with IPv6.  Thus, they could benefit from any means which make
   mapping the networks easier.  For example, if a security threat
   targeted at routers or even home agents is discovered, having a
   simple ICMP mechanism to easily find out possible targets may prove
   to be an additional (though minor) security risk.

   Apart from discovering the address(es) of home agents, attackers will
   not be able to learn much from this information, and mobile nodes
   cannot be tricked into using wrong home agents, as all other
   communication with the home agents is secure.

NEW:

15.5.  Dynamic Home Agent Address Discovery

   The dynamic home agent address discovery function could be used to
   learn the addresses of home agents in the home network.

   The ability to learn addresses of nodes may be useful to attackers
   because brute-force scanning of the address space is not practical
   with IPv6.  Thus, they could benefit from any means which make
   mapping the networks easier.  For example, if a security threat
   targeted at routers or even home agents is discovered, having a
   simple ICMP mechanism to easily find out possible targets may prove
   to be an additional (though minor) security risk.

*  This document does not define any authentication mechanism for 
*  dynamic home agent address discovery messages. Therefore the home
*  agent does not know the identity of the mobile node that requested
*  the list of home agents.

   Apart from discovering the address(es) of home agents, attackers will
   not be able to learn much from this information, and mobile nodes
   cannot be tricked into using wrong home agents, as all other
   communication with the home agents is secure.

*  In cases where security is needed, it is advisable to consider the
*  use of MIPv6 bootstrapping [Boot-Integrated] [Boot-Split], in
*  conjunction with security mechanisms suggested in these
*  specifications, instead of the DHAAD mechanism.
*
*  Finally, it should be noted that the DHAAD mechanism is based on
*  ICMP and as such, it will not work in networks that are configured
*  to block ICMP messages.
------------------------------------------------------------------------
_______________________________________________
MEXT mailing list
MEXT at ietf.org
https://www.ietf.org/mailman/listinfo/mext