Using IPsec to Protect Mobile IPv6 Signaling Between Mobile Nodes and Home Agents
updated by
- rfc-4877 — Mobile IPv6 Operation with IKEv2 and the Revised IPsec Architecture
Extracted elements (29)
IKEv1 main mode with preshared secrets cannot determine the correct key from a care-of address (unlike a stable home address), requiring aggressive mode when preshared secrets are used; certificates with home addresses in SubjectAltName are also complicated because many IKE implementations cannot carry IKE on one address while another is named in the certificate.
The care-of address is used as the outer tunnel destination (rather than home address plus routing header) to avoid a 24-byte overhead per packet; while insignificant for return routability, the overhead would be problematic for real-time payload traffic. This choice requires the home agent to update the SA destination upon each movement.
IKE fragmentation can occur when certificate chains are used; many firewalls and routers drop fragments, preventing SA establishment. Mitigation options include storing peer certificates locally or obtaining them through other means.
Per RFC 2401, the outer source address in tunnel packets is not checked, allowing the mobile node to use its new care-of address as the source of existing tunnel-mode security associations after movement without rekeying; however, some implementations are known to make source address checks.
ESP encapsulation of Binding Updates and Acknowledgements between the mobile node and home agent MUST be supported and MUST be used by both home agents and mobile nodes.
ESP encapsulation of Home Test Init and Home Test messages tunneled between mobile node and home agent MUST be supported and SHOULD be used; ESP of ICMPv6 prefix discovery messages MUST be supported and SHOULD be used.
If anti-replay protection is required, dynamic keying MUST be used, since IPsec can only provide anti-replay protection when dynamic keying is employed; the combination of dynamic keying, IPsec anti-replay, and Mobile IPv6 sequence numbers is needed to prevent replay and reordering attacks.
If IKEv1 is used with preshared secrets, aggressive mode MUST be used because main mode determines the shared secret from the peer IP address, which may be a care-of address and does not identify the mobile node.
If multicast group membership control protocols (MLDv1, MLDv2) or stateful address autoconfiguration protocols (DHCPv6) are supported, payload data protection MUST be supported for those protocols.
IPsec protection for return routability and payload packets MUST only be applied to traffic entering the IPv6 encapsulated tunnel interface between mobile node and home agent, achieved by defining SPD entries specific to the tunnel interface rather than the physical interface.
Manual configuration of IPsec security associations MUST be supported; keys are expected to be configured out-of-band at provisioning time.
Mobile IPv6 implementations MUST use the Alternate Care-of Address mobility option in Binding Updates sent by mobile nodes while away from home, so that the care-of address is covered by ESP protection.
The SPD entries MUST unequivocally identify a single security association (manual keying) or single IKE phase 1 credentials (dynamic keying) for protecting Binding Updates between any given home address and home agent, to prevent a mobile node from impersonating another mobile node sharing the same home agent.
Tunnel mode IPsec ESP MUST be supported and SHOULD be used for protection of return routability packets; both a non-null encryption transform and a non-null authentication algorithm MUST be applied to prevent on-link attackers from observing tokens.
When a packet is matched against IPsec security policy, an address in a Home Address destination option MUST be treated as the source address, and a home address in a Type 2 Routing header MUST be treated as the destination address.
When dynamic keying is used, the key management protocol MUST use the care-of address as the source address in IKE exchanges with the home agent, but the IPsec security associations MUST be requested using the mobile node's home address as the client identity.
When IPsec protects return routability or payload packets, the mobile node MUST set the source address of outgoing tunnel packets to its current primary care-of address, switching immediately after sending a Binding Update registering a new address.
When securing Binding Updates, Acknowledgements, and prefix discovery, both nodes MUST support and SHOULD use ESP in transport mode, and MUST use a non-null payload authentication algorithm to provide data origin authentication, connectionless integrity, and optional anti-replay protection.
When the care-of address changes due to an accepted Binding Update, the home agent MUST set the new care-of address as the destination of tunnel packets for existing security associations, as if the outer header destination address had changed; this MUST only be done based on IPsec-protected Binding Updates.
When the mobile node returns home and de-registers, the IPsec security policy entries used for protecting tunneled traffic MUST be made inactive; manually-configured security associations MUST be retained for reuse when the node later moves away again.
IKE phase 1 is run over care-of addresses (src=care-of address, dst=home agent) while IKE phase 2 negotiates security associations using home addresses as selectors (IDci=ID_IPV6_ADDR home address), allowing the SA to persist across movements without rekeying.
The Key Management Mobility Capability (K) flag in Binding Update and Binding Acknowledgement messages indicates whether the mobile node and home agent have the capability to move IKE phase 1 endpoints to a new care-of address without re-establishing phase 1.
SA outer-header destination updates MUST only be performed based on Binding Updates received and protected by IPsec; allowing such modifications from other sources (correspondent-node BUs or open API access) creates security vulnerabilities enabling traffic hijacking.
Unprotected Mobile IPv6 control traffic exposes mobile nodes, home agents, and third parties to man-in-the-middle, hijacking, passive wiretapping, impersonation, and denial-of-service attacks; ESP protects Binding Updates so an attacker cannot redirect a mobile node's traffic to a third party.
Binding Acknowledgement to a mobile node away from home uses: IPv6 header (src=home agent, dst=care-of address), Type 2 Routing header (home address), ESP header in transport mode, Mobility header with Binding Acknowledgement.
Binding Update from a mobile node away from home uses: IPv6 header (src=care-of address, dst=home agent), Destination Options header with Home Address option (home address), ESP header in transport mode, Mobility header with Binding Update including Alternate Care-of Address option.
Home Test Init tunneled to the home agent with IPsec uses: outer IPv6 header (src=care-of address, dst=home agent), ESP header in tunnel mode, inner IPv6 header (src=home address, dst=correspondent node), Mobility Header with Home Test Init.
Mobile Prefix Solicitation from a mobile node uses: IPv6 header (src=care-of address, dst=home agent), Destination Options header with Home Address option, ESP header in transport mode, ICMPv6 Mobile Prefix Solicitation.
Payload packets tunneled to the home agent with IPsec use: outer IPv6 header (src=care-of address, dst=home agent), ESP header in tunnel mode, inner IPv6 header (src=home address, dst=correspondent node), any protocol.