Re: threats ID

[Masataka Ohta <mohta@necom830.hpcl.titech.ac.jp>]

Marcelo;

> IMHO both drafts complement themselves pretty well because Erik & Tony's
> draft essentially analyze the threats from a IP layer perspective and
> Masataka's draft analize the threats from a transport layer perspective.

The problem for Erik and Tony, then, is that IP layer of
multi6 is no different from the current one.

> After some mail exchanges with Pekka N., my understanding is that that there
> is an important distinction to be made between these two cases when
> considering the hijacking attack.

Good.

Can you answer the following simple question?

What, do you think, is being hijacked?

Connections?

Note that, unless you extensibly modify IP layer, there is no
connections there.

> The point is that in transport layer
> solutions, the hijcack attack is limited to the existent established
> connection while in the IP layer (shim layer also) solutions the attack
> applies to the complete endnode.

Wrong. Attack is always applied to the end.

> Because the attack applies to the endnode,
> the attacker can do things like establishing aconnection creating some state
> so that futuer communications initated by the victim are also redirected.

Establishing a connection is a functionality of the transport
layer.

> That is in IP layer solutions the complete identity of the victim

There is no IP layer solutions.

Just like NAT operates not only at the IP layer but also at the
transport and applicaiton layers, shim layers are not only at
the IP layer.

> So I guess that i agree with Masataka that a return routability check with a
> cookie is enough to redirect a connection but IMHO this is not enough to
> redirect a complete identity at the IP layer level.
> I mean time shifting attacks may be acceptable as long they can only affect
> a connection.

"Time shifting attack" is meaningful if only there is persistent
relationship, that is connection, that it is not at the
connectionless layer.

						Masataka Ohta