Subject: [savi] On the Protection of Unused Addresses

From: Christian Vogt <[email-masked]>
Date: Wed, 24 Jun 2009 19:04:49 -0700

On Jun 23, 2009, Fred Baker wrote on thread "Your opinion on a different
tradeoff for SAVI":

> SAVI without protecting unused addresses is pointless.

Fred and all -

Protection of unused addresses would, of course, be a useful feature.
But before making this mandatory, we should do a benefit-cost analysis.
Here is one, along with a proposal of how to move forward:

The benefit of protecting unused addresses is that it prevents an
attacker from hiding its identity or location.  An attacker who wants to
do this can use any source address as long as it is not its own address.
Protecting unused addresses is especially useful in networks where DHCP
is the only permitted method for address configuration, since those
networks are in control of which addresses are used.  On the other hand,
in networks where Stateless Address Autoconfiguration is permitted, it
is up to the (potentially malicious) hosts which addresses are used.
Protecting unused addresses then has little benefit:  All it achieves is
requiring an attacker to formally turn an unused address into a used
address by sending a DAD solicitation.

The cost of protecting unused addresses is a need to coordinate multiple
SAVI devices on the same link.  If this coordination does not exist, or
is insufficient, legitimate packets may get dropped, because one SAVI
device may consider unused an address that is in fact in use at another
SAVI device.  Coordination between SAVI devices, in turn, can be
accomplished in one of two ways:

- By partitioning the scope of SAVI protection into one area per SAVI
   device.  This requires manual configuration of SAVI devices, since
   switch ports that connect to other SAVI devices must be labeled as
   such. Link partitioning is the approach of the CPS solution.

- By synchronizing binding state across SAVI devices so that each SAVI
   device can validate addresses from anywhere else on the link.  This
   requires an extra binding distribution protocol, plus extra memory
   for binding state copied from other SAVI devices.  Synchronization
   was proposed as an add-on to the original FCFS solution.

Either form of coordination implies an undesired cost for protecting
unused addresses.  Given this cost, and given that the main benefit is
in networks where DHCP is the only permitted address configuration
method, a potential way to move forward may be to make the protection
of unused addresses optional and limited to those DHCP-only networks.
More specifically, we could add an optional "DHCP-only mode" to SAVI,
in which SAVI devices would permit only those addresses that have been
explicitly assigned via DHCP.  In DHCP-only mode, SAVI devices would:

- Create bindings only based on DHCP address assignments, but not based
   on DAD solicitations.

- Drop packets with unused source addresses.

As a method for inter-SAVI-device coordination, I suggest partitioning
the scope of SAVI protection.  Thus, network administrators who enable
DHCP-only mode may also have to manually designate switch ports that
connect to other SAVI devices.  This extra manual configuration should
be acceptable given that the DHCP-only mode already needs to be turned
on manually.  At the same time, link partitioning avoids the extra
complexity and manufacturing cost that synchronization would entail.

What do folks think?  Would this be a reasonable approach?

- Christian

---

From: Fred Baker <[email-masked]>
Date: Wed, 24 Jun 2009 20:12:55 -0700

> But before making this mandatory, we should do a benefit-cost  

we should also consider the problem statement, which was that folks  
wanted to prevent viruses etc from using addresses not assigned to them.

Speaking as someone who has a product in the field that does this, and  
therefore has a handle on both the costs and the customer statements  
made when buying equipment with that feature, I think this is a very  
straightforward value proposition.

---

From: Christian Vogt <[email-masked]>
Date: Thu, 25 Jun 2009 15:44:03 -0700

> straightforward value proposition.

Fred -

I understand your arguments.  Yet, as I explained in my previous email,
I think it is hard, perhaps impossible, to build a non-disruptive and
cost-efficient SAVI solution that protects unused addresses in networks
where Stateless Address Autoconfiguration is permitted.  What do you
think of the proposal to limit the protection of unused addresses to
networks that use only DHCP for address assignment?

- Christian

---

From: Fred Baker <[email-masked]>
Date: Thu, 25 Jun 2009 16:00:06 -0700

Given that there is no product on the market today that uses DHCP for  
address assignment...

it seems vacuous.

---

From: "Greg Daley" <[email-masked]>
Date: Fri, 26 Jun 2009 09:34:02 +1000

address assignment...

No product announcements ?

;-)

Greg

---

From: Christian Vogt <[email-masked]>
Date: Mon, 29 Jun 2009 16:12:07 -0700

Folks -

I would like to solicit more feedback on the benefit-cost analysis
(below) for protecting unused addresses. How valuable do people consider
protection of unused addresses, how much cost do they think is OK?  Is
there something that the analysis overlooks?  We already got several
very useful comments from a few people.  What do the others think?

To recap:  We need to decide between the following three options of
dealing with unused addresses:

- Not protect unused addresses, i.e., forward packets without a binding.
   Logging is still possible, though.

- Protect unused addresses, and coordinate SAVI devices on the same link
   by manually disabling SAVI protection on ports connecting to other
   SAVI devices.

- Protect unused addresses, and coordinate SAVI devices on the same link
   with a dedicated binding synchronization protocol.

Please send your feedback by Sunday, July 5.  We will vote after that.

- Christian

---

From: Christian Vogt <[email-masked]>
Date: Mon, 29 Jun 2009 16:19:38 -0700

On Jun 25, 2009, Fred Baker wrote:

>> What do you think of the proposal to limit the protection of unused
>> addresses to networks that use only DHCP for address assignment?
>

At this point, there are no products that support SAVI in IPv6 either.
And yet we are hoping for those to be developed.  Why wouldn't the same
apply to DHCPv6 products if those proved to enable higher security in
conjunction with SAVI?

- Christian

---

From: "Joel M. Halpern" <[email-masked]>
Date: Mon, 29 Jun 2009 19:36:43 -0400

While I appreciate Christian's question, I think that this is part of a 
larger pair of questions that we talk around, but do not address.

1) What threats are we actually trying to protect against.  The threats 
draft talks about general internet threats and the need to be able to 
track them back.  But it is not particularly clear about what behavioral 
threats we are actually concerned with stopping in SAVI
- Are we concerned with ensure that every packet leaving a site can be 
reliably tracked back to a human being
- Are we concerned with preventing one device within a site from 
masquerading as another device, either at the IP or MAC layer.

2) What tools do we want to require or prohibit.  While we probably do 
not want to mandate a single tool set, without mandating something we 
get nowhere.  Possibilities include
- restricting mobility (with or without session continuity)
- Requiring MAC or IP authentication (*02.1X, SEND, ...)
- Requiring central management of addressing and bindings

No, those are not all the alternatives.  As far as I can tell from 
watching this list, there are folks who take as given the need for 
almost any subset of these and related constraints you can imagine. 
Unless we pick, explicitly, we will continue to argue in circles.

For example, the question of controlling unregistered addresses turns on 
assumptions about what threats we are addressing, and assumptions about 
address allocation that mean that "unregistered" is a meaningful 
condition.  I don't object to that particular pair, but it is really 
hard to discuss the acceptability of answers without agreeing on the 
questions.

Yours,
Joel M. Halpern

---

From: Christian Vogt <[email-masked]>
Date: Mon, 29 Jun 2009 19:42:42 -0700

Joel -

I agree with you that the Threats document needs a revision.  But the
question at hand at this stage is actually very clear:  Do we want to
protect unused addresses despite the complexity this requires?  And part
of the answer to this question will be exactly what you call us to agree
upon:  Which attacks SAVI should protect against, and which tools SAVI
should require.

The attacks SAVI would prevent if SAVI were to protect unused addresses
are those where the attacker wants to hide its identity or location.
Without protecting unused addresses, SAVI would only prevent
impersonation attacks.  The tools SAVI could use to protect unused
addresses are manual configuration or a separate binding distribution
protocol.  We should extend this list if there are more tools.

I understand that your arguments relate to SAVI in general, not to the
particular question we are discussing now.  But I suggest to discuss one
question after the other, and to tackle now the important question at
hand.  One may argue that we should have discussed this question long
before, but only now do we fully understand the consequences that the
possible answers have.

- Christian

On Jun 29, 2009, Joel M. Halpern wrote:

>     draft talks about general internet threats and the need to be able
>     to track them back.  But it is not particularly clear about what
>     behavioral threats we are actually concerned with stopping in SAVI
>
>     not want to mandate a single tool set, without mandating something
>     we get nowhere.  Possibilities include
>

---

From: Christian Vogt <[email-masked]>
Date: Mon, 29 Jun 2009 19:45:55 -0700

Joel -

>   masquerading as another device, either at the IP or MAC layer.

It is the latter.  Tracing humans was explictly deemed out of scope
during the working group chartering discussion.

- Christian