Re: Is Cookies really useful?

Tan, Tat Kin wrote:
> Hello,
> 
> Am reading the MIPv6 draft (ipv6-22.txt) version and came across an area where it describes the needs for Cookies and Tokens in section 5.2.3.
> 
> It says that the implementation of cookies "can also serve to ensure parties who have not seen the request cannot spoof response..."
> 
> I wonder how the validity of this statement? I assume that part of the communication between MN and CN will involve one sending "previous communicated message" ie cookie to another and requesting the correspondent to response. If an attacker sits in between the link and recorded the exchanging msgs, he could simply replay the spoofed msg and pretended he is "CN" when MN asked for cookies to be exchanged. Unless the cookies is encrypted.
> 
> It is rather confusing when cookies is said to be served in this manner. Or is cookies served in other functional area? 

The cookies serve two purposes:

1) Match responses to requests
2) Make it necessary for the attacker to be on-path when spoofing a response

Since the MN picks and verifies a cookie, no invalid cookies can be used.
However, an attacker can still steal an existing cookie if he is on the
path from either the request or the response, and use that. But he needs
to be on path, and thats one thing that the cookie mechanism adds as a
requirement. Without cookies, anyone on the Internet could "reply" to a
care-of test message, for instance.

--Jari