Subject: Re: [6lo] Secure 6LoWPAN ND draft-sarikaya-6lo-cga-nd-01

From: Behcet Sarikaya <[email-masked]>
Date: Fri, 27 Jun 2014 16:50:23 -0500

Hi Pascal,

On Fri, Jun 20, 2014 at 6:25 AM, Pascal Thubert (pthubert)
<[email-masked]> wrote:
> HI Behcet:
>
> Interesting work, certainly worth pursuing IMHO.
>

Thanks for your support.

> I agree with your position that:
> "
> An LSEND for LLN node MUST set the Owner
>    Interface Identifier field (EUI-64) in ARO to the rightmost 64 bits
>    of its crypotographically generated address.
> "
>

Good.

> This makes a lot of sense and binds the registered address to the CGA-based OII.
> Note that since the packets carry the OII, we do not need the source address to match that CGA anymore.
> So I disagree with:
>
> "
>    6LBR receives the address registration NS. 6LBR then verifies the
>    source address as described in Section 5.1.2. of [RFC3971] using the
>    claimed source address and CGA Parameters field in the message.
> "
>
> LSeND will by us that all the signed message with that OII come from a same party.

This above sentence I am having trouble parsing, I hope you can clarify?

> Then, if that party if the first to claim any address it likes, then it becomes owner of that address and the address is bound to the CGA in the 6LR registry.

I guess here you want to say if that party IS the first to claim.

So you are saying that as long as the OII is included in the source
address we do not need to check the rest?
The first "party" to claim it is OK. What do you mean by "party"?

> The idea is that we do not want the constrained device to compute multiple keys for multiple addresses.
> The registration process allows us to tie all the addresses to a same OII and have the 6LR/6LBR enforce first come first serve after that.
> Would you agree?

I would agree but the thinking in the draft was there would be one
source address.
If we want to consider multiple source addresses, which is probably a
good idea for IPv6 then your idea I think makes sense.
Can you then provide some text on why multiple source addresses need
to be considered?

>
> The next problem is the DAR/DAC message. Seems to me that the content that the source signs and the signature needs to be propagated to the 6LBR.
> Again do you agree?

DAR/DAC is in RFC 6775 but not an issue in LSEND. Why do you think it should be?

>
> On the side, I'm trying to get Efficient ND and 6LoWPAN ND to register the target of the message as opposed to the source (http://tools.ietf.org/html/draft-thubert-6lo-rfc6775-update-reqs-01). Unsure I'll get somewhere with that but if so, it makes sense to indicate "the registered address" as opposed to "the source address".
>

Sure, I think that all these efforts to improve RFC 6775 need to be pursued.

Regards,

Behcet
> Cheers,
>
> Pascal
>
>
>> -----Original Message-----
>> From: 6lo [mailto:[email-masked]] On Behalf Of Behcet Sarikaya
>> Sent: lundi 19 mai 2014 21:31
>> To: [email-masked]
>> Subject: [6lo] Secure 6LoWPAN ND
>>
>>  Hi all,
>>
>> I have  a draft on securing RFC 6775 using a form of SeND, the draft is at:
>>
>> http://www.ietf.org/id/draft-sarikaya-ace-cga-nd-00.txt
>>
>> Ulrich and Samita told me that such issues are in scope with 6lo.
>>
>>
>> I'll appreciate your comments on this draft.
>>
>> Regards,
>>
>> Behcet
>>
>> _______________________________________________
>> 6lo mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/6lo

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Mon, 30 Jun 2014 10:05:21 +0000

Sorry, Behcet for the typo:

will by us -> will buy us.

Please see below.

> This above sentence I am having trouble parsing, I hope you can clarify?
[PT] I mean that the 6LR/6LBR can validate that the further registration / claim for an address is done with the same UII. So a host cannot steal an address that is already registered unless it has the key for the UII. The same UII can thus be used to protect multiple addresses that are not necessarily based on the UII for the IID part.. 

> So you are saying that as long as the OII is included in the source address we
> do not need to check the rest?

[PT] No I am saying that we need to change SeND to use the UII for the CGA calculation as opposed to the source address.
It is more stable and a device could register all its addresses with a single CGA-based UII / keypair
 
> 
> I would agree but the thinking in the draft was there would be one source
> address.
> If we want to consider multiple source addresses, which is probably a good
> idea for IPv6 then your idea I think makes sense.
> Can you then provide some text on why multiple source addresses need to
> be considered?

[PT] Right now 6LoWPAN registers the source address. But I wish to change that to register the target.
 
> >
> > The next problem is the DAR/DAC message. Seems to me that the content
> that the source signs and the signature needs to be propagated to the 6LBR.
> > Again do you agree?
> 
[PT] I think the 6LBR must be aware of who (which UII) owns an address to defend the first user if there is an attacker on another 6LR.

> >
> > On the side, I'm trying to get Efficient ND and 6LoWPAN ND to register the
> target of the message as opposed to the source
> (http://tools.ietf.org/html/draft-thubert-6lo-rfc6775-update-reqs-01). Unsure
> I'll get somewhere with that but if so, it makes sense to indicate "the
> registered address" as opposed to "the source address".
> >
> 
[PT] I hope both drafts are presented in Toronto so we can have that chat live;

Cheers,

Pascal