Subject: Re: [6lo] Secure 6LoWPAN ND draft-sarikaya-6lo-cga-nd-01

From: Behcet Sarikaya <[email-masked]>
Date: Tue, 1 Jul 2014 11:19:52 -0500

Hi Pascal,

Thanks for your reply. Further questions below.

On Mon, Jun 30, 2014 at 5:05 AM, Pascal Thubert (pthubert)
<[email-masked]> wrote:
> Sorry, Behcet for the typo:
>
> will by us -> will buy us.
>
> Please see below.
>
>> From: 6lo [mailto:[email-masked]] On Behalf Of Behcet Sarikaya
>> > So I disagree with:
>> >
>> > "
>> >    6LBR receives the address registration NS. 6LBR then verifies the
>> >    source address as described in Section 5.1.2. of [RFC3971] using the
>> >    claimed source address and CGA Parameters field in the message.
>> > "
>> >
>> > LSeND will by us that all the signed message with that OII come from a
>> same party.
>>
>> This above sentence I am having trouble parsing, I hope you can clarify?
>>
> [PT] I mean that the 6LR/6LBR can validate that the further registration / claim for an address is done with the same UII. So a host cannot steal an address that is already registered unless it has the key for the UII. The same UII can thus be used to protect multiple addresses that are not necessarily based on the UII for the IID part..
>
>> So you are saying that as long as the OII is included in the source address we
>> do not need to check the rest?
>
> [PT] No I am saying that we need to change SeND to use the UII for the CGA calculation as opposed to the source address.
> It is more stable and a device could register all its addresses with a single CGA-based UII / keypair
>
>>
>> I would agree but the thinking in the draft was there would be one source
>> address.
>> If we want to consider multiple source addresses, which is probably a good
>> idea for IPv6 then your idea I think makes sense.
>> Can you then provide some text on why multiple source addresses need to
>> be considered?
>
> [PT] Right now 6LoWPAN registers the source address. But I wish to change that to register the target.

[Behcet] You mean the target address or the destination address? That
is another big change, I think? Also it somewhat contradicts your
earlier point?

>
>> >
>> > The next problem is the DAR/DAC message. Seems to me that the content
>> that the source signs and the signature needs to be propagated to the 6LBR.
>> > Again do you agree?
>>
>> DAR/DAC is in RFC 6775 but not an issue in LSEND. Why do you think it
>> should be?
>>
> [PT] I think the 6LBR must be aware of who (which UII) owns an address to defend the first user if there is an attacker on another 6LR.

[Behcet]
Thanks for all these pointers for a revision. I think it is fairly
major change. So I decided to make a minor revision to add one
paragraph one these ideas.
I hope to present the draft in Toronto and hopefully to get some
feedback and see what happens.

Regards,

Behcet
>
>> >
>> > On the side, I'm trying to get Efficient ND and 6LoWPAN ND to register the
>> target of the message as opposed to the source
>> (http://tools.ietf.org/html/draft-thubert-6lo-rfc6775-update-reqs-01). Unsure
>> I'll get somewhere with that but if so, it makes sense to indicate "the
>> registered address" as opposed to "the source address".
>> >
>>
>> Sure, I think that all these efforts to improve RFC 6775 need to be pursued.
>>
> [PT] I hope both drafts are presented in Toronto so we can have that chat live;
>
> Cheers,
>
> Pascal
>
>> Regards,
>>
>> Behcet

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Wed, 2 Jul 2014 08:02:44 +0000

> Thanks for all these pointers for a revision. I think it is fairly major change.
> So I decided to make a minor revision to add one paragraph one these ideas.
> I hope to present the draft in Toronto and hopefully to get some feedback
> and see what happens.

I hope too Behcet; I'm sure you made a formal request to the chairs?

> [Behcet] You mean the target address or the destination address? That is
> another big change, I think? Also it somewhat contradicts your earlier point?
My view is this:

I mean we use the EUI-64 based LL as source for the registration. That one does not need DAD.
The registered address is the target of the NS. Can be based on any IID, in some sensor networks that is and must be administrative. Can be many.
The CGA is the UII in the ARO not any of source, destination or target IPv6 addresses. The same CGA can be used to claim multiple targets. The 6LR/6LBR ensures first-come/first-serve by keeping the ARO and the crypto material correlated to the target being registered.
As part of this material the public key is passed to and stored by the 6LR/6LBR on the first contact. So there is no need to pass it on again and again. On exceptional loss, a 6LR that is missing the crypto information should be able to ask for it again. The signed material from the NS(ARO) must be passed as is into the DAR message so the 6LBR can (re)validate and store so as to make sure that the 6LR is not a fake.

Does that make sense?

Yes, that means some change, and I understand that your draft can not reflect that for this round. The change of using the target is also needed for a number of reasons that I will elaborate on my own presentation. Yet I hope we can discuss it at the WG... Maybe you could have a slide with the proposal above to get a sense of the room.

Cheers,

Pascal

> -----Original Message-----
> From: Behcet Sarikaya [mailto:[email-masked]]
> Sent: mardi 1 juillet 2014 18:20
> To: Pascal Thubert (pthubert)
> Cc: [email-masked]
> Subject: Re: [6lo] Secure 6LoWPAN ND draft-sarikaya-6lo-cga-nd-01
> 
> Hi Pascal,
> 
> > [PT] I mean that the 6LR/6LBR can validate that the further registration /
> claim for an address is done with the same UII. So a host cannot steal an
> address that is already registered unless it has the key for the UII. The same
> UII can thus be used to protect multiple addresses that are not necessarily
> based on the UII for the IID part..
> >
> >> So you are saying that as long as the OII is included in the source
> >> address we do not need to check the rest?
> >
> > [PT] No I am saying that we need to change SeND to use the UII for the
> CGA calculation as opposed to the source address.
> >> I would agree but the thinking in the draft was there would be one
> >> source address.
> >> If we want to consider multiple source addresses, which is probably a
> >> good idea for IPv6 then your idea I think makes sense.
> >> Can you then provide some text on why multiple source addresses need
> >> to be considered?
> >
> [Behcet] You mean the target address or the destination address? That is
> another big change, I think? Also it somewhat contradicts your earlier point?
> 
> >
> >> >
> > [PT] I think the 6LBR must be aware of who (which UII) owns an address to
> defend the first user if there is an attacker on another 6LR.
> 
> [Behcet]
> Thanks for all these pointers for a revision. I think it is fairly major change.
> So I decided to make a minor revision to add one paragraph one these ideas.
> I hope to present the draft in Toronto and hopefully to get some feedback
> and see what happens.
> 
> Regards,
> 
> Behcet
> >
> >> >
> >> (http://tools.ietf.org/html/draft-thubert-6lo-rfc6775-update-reqs-01)
> >> . Unsure I'll get somewhere with that but if so, it makes sense to
> >> indicate "the registered address" as opposed to "the source address".
> >> >
> >>

---

From: Ulrich Herberg <[email-masked]>
Date: Wed, 2 Jul 2014 08:30:54 -0700

Pascal,

On Wed, Jul 2, 2014 at 1:02 AM, Pascal Thubert (pthubert)
<[email-masked]> wrote:
[...]
> I hope too Behcet; I'm sure you made a formal request to the chairs?

I have replied to Behcet off-list. We have received the formal
request. Samita and I will be putting together the agenda in the next
few days.

Best regards
Ulrich