Subject: Re: Security Considerations for Next Header value 59 [was Re: Review of draft-ietf-6man-rfc2460bis-05]

From: "C. M. Heard" <[email-masked]>
Date: Wed, 21 Sep 2016 22:57:32 -0700

On 2016-09-21 Bob Hinden wrote:
> I would be good to understand how we got the text:
>
>       If the Payload Length field of the IPv6 header
>       indicates the presence of octets past the end of a header whose
>       Next Header field contains 59, those octets must be ignored, and
>       passed on unchanged if the packet is forwarded.
>
> I don’t know, maybe someone can do some searches.  I suspect there
> may have been some reason behind it.

Not necessarily the reason why it was put in, but ESP uses this as a
means to send dummy packets, which are used for the purpose of traffic
flow confidentiality. See:

https://tools.ietf.org/html/rfc4303#section-2.6

ESP of course hides the Next Header within the encrypted part of the
packet, so no firewall or traffic normalizer will see the No Next Header
value. That effectively defeats filtering it out or scrubbing any dummy
bytes that happen to follow it.

Mike Heard

P.S. As an aside, my small mind struggles with the notion of worrying
about the security threat from covert communication channels when
ubiquitous use of encryption is strongly encouraged ... maybe
someone will point me to a reference that will tell me what obvious
point I am missing.

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 23 Sep 2016 11:17:48 +1200

> someone will point me to a reference that will tell me what obvious

Two points:

1. I suspect that any covert channel could be viewed as a potential
attack. In this specific case it's a potential buffer overflow attack.
In another case (e.g. non-zero pad bytes) it might just be a way to
exploit lazy code that assumes those bytes are zero.

2. An unencrypted covert channel is undesirable from at least two points of view:
- from the user's view, it's foolish to assume that it is in any way private;
clearly it's subject to surveillance.
- from the corporate security view, it's a way of bypassing corporate
confidentiality rules, so it's going to be a firewall target.

In fact I think it's only the SIGINT community (both legal and illegal)
that would benefit.

Regards
   Brian

On 22/09/2016 17:57, C. M. Heard wrote:
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

---

From: [email-masked]
Date: Fri, 23 Sep 2016 14:03:26 +0200

Brian,

> In fact I think it's only the SIGINT community (both legal and illegal)

At least if the protocol 59 was used as a covert channel, it is a pretty obvious one to detect.

Best regards,
Ole