Subject: RE: Solutions ...

From: "Hesham Soliman (ERA)" <[email-masked]>
Date: Thu, 24 Jan 2002 14:11:50 +0100

Hi, 

  > > I think there are two very different issues here.
  > > 
  > > 1. Authentication transport protocol which can optionally 
  > accommodate
  > > session key agreement
  > > 
  > > 2. Secured Neighbor Discovery.
  > 
  > To be more specific I'd actually like to separate 2 into
  > 2a. Secured Host-Router interaction in Neighbor Discovery
  > 2b. Secured Host-to-Host interaction in Neighbor Discovery
  > 
  > The issues in authenticating and authorizing a router might 
  > be rather
  > different than AA'ing a host.

=> I fullly agree.
I can think of scenarios where after authentication
a host is issued a key for protecting RS and 
authenticating RAs. However, for NS and NA this 
is a different problem. 
So it may be doable without too much trouble.

I think if we're going to the level of protecting 
ND, then a safe and easy (relatively) way to do it
is to run the ND communication between hosts and 
routers over a secure channel. As for host to host
we would probably have to do so via the AR. 

Hesham

---

From: "James Kempf" <[email-masked]>
Date: Thu, 24 Jan 2002 10:13:27 -0800

Hesham,

> we would probably have to do so via the AR. 

If by 'secure channel' you mean that Layer
2 is as secure as a wired network, I don't think running 
ND over a secure channel will eliminate the
threat entirely.

Consider the following scenario. A fully authenticated
host on the secure channel suddenly decides to play
the trickster and starts advertising itself as a router,
and sending out RAs for the real router with
lifetime zero. At some point, the host will get
found out, and the user's account will be cancelled
(perhaps even with legal action) but until
that time, the host can do a lot of damage.

The current ND scheme basically depends
on implicit trust between hosts and the
routers or router on the link. In a public
access network, even if all hosts are authenticated
and the channel is secure, because the signaling isn't
authenticated, there is still the potential for damage.

            jak

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 24 Jan 2002 17:36:23 +0100 (CET)

> we would probably have to do so via the AR. 

But that would make broadcast and multicast on the local link
very efficient; the host would unicast to the router and the router
would need to send out N copies over every secure channel to every other host.

  Erik