context confusion

[marcelo bagnulo braun <marcelo@it.uc3m.es>]

Hi,

another issue that is still open is what the draft calls context 
confusion

The situation here is that we have hosts A and B that setup a shim 
context between them
the context has ULID(A) and ULID(B). For that context each  peer has 
assigned a context tag, CT(A) and CT(B)

suppose now that host B discards the state but A keeps it.

suppose that later on, a new context is established between A and B and 
that B reuses CT(B) for this new context.
In the case that the ULID or the locators used by B in this new context 
contain at least one of the addresses used by B in the previous 
context, A is able to detect the situation that we call context 
confusion. Such detection can occur whether when A receives a I1, an I2 
or an R2 message for this new context.

The question is: what does A does when it detect this context confusion?

There seems to be reasonable to continue with the new context 
establishment, using CT(B) for this new context, but what does A does 
with the old context?
There are two proposed approaches:
- Discard the old context
- try to reestablish the old context with a different context tag for B

Now, the problem with discarding the old context is that this may open 
the door to some form of attacks, when an attacker that discovers a 
context tag and a valid locator of a given peer, can easily, by just 
sending a I1 message make the victim to discard the state. In other 
words, if we have the scenario above with A and B having an 
estasblished context, an attacker can simply send an I1 message to A 
that includes the CT(B) and an ULID option with B's address and this 
would cause A to discard the context with B. Of course, it would 
require that the attacker knows CT(B) and B's address, would this 
threat be acceptable? An additional option would be to delay context 
teardown of the old context until a I2 or an R2 packet is received, 
making sure that we can track down an attacker....

The other option is that upon the reception of a shim control packet 
that causes context confusion detection, A tries to reestablish the 
context, that is, it sends a new I1 packet for the old context and see 
what happens. If the peer still has the old context (i.e. we are under 
attack) then the peer will respond with a R2 message and the attack is 
detected and no problem. If the peer actually has lost the context, it 
will reply with an R1 message and the situation is that the peer has 
discarded the context, and A can choose to restore it or not. In any 
case, there is still an open question is when does A sends the I1 
message: upon the reception of I1 or upon the reception of I2? I guess 
that we don't want to do anything when we receive a I1, and we better 
do it when we receive an I2 or an R2, when we have more confidence on 
what is going on...

So, what option do you prefer?

Regards, marcelo