Subject: Re: Sufficient email authentication requirements for IPv6

From: Douglas Otis <[email-masked]>
Date: Tue, 2 Apr 2013 21:29:17 -0700

On Mar 30, 2013, at 11:26 PM, Christian Huitema <[email-masked]> wrote:

>> IPv6 makes publishing IP address reputations impractical.  Since IP address reputation has been a primary method for identifying abusive sources with IPv4, imposing ineffective and flaky > replacement strategies has an effect of deterring IPv6 use. 
> 
> In practice, the /64 prefix of the IPv6 address has very much the same "administrative" properties as the /32 value of the IPv4 address. It should be fairly straightforward to update a reputation system to manage the /64 prefixes of IPv6. This seems somewhat more practical than trying to change the behavior of mail agent if their connectivity happens to use IPv6.

Dear Christian,

The announced prefix space currently represents more than 4 million times the entire IPv4 address space.  This means the /64 prefix space can not be considered comparable to IPv4 address space.  Go to http://bgp.potaroo.net/v6/as2.0/ and look for Total address space advertised (/64 equiv).  The number of announced prefixes over /64s currently shows 18,206,079,529,779,202.

Much of the IPv4 has already had Reverse DNS PTR records traversed scanning for hints about whether any specific address appears to represent dynamically assigned access.  This guesswork allows about 1/3 of the IPv4 space to be ignored by blocking them from sending public (port 25) SMTP messages.

Reverse DNS PTR records offers a costly means to differentiate residential and non-residential access when done on a realtime basis.  A significant benefit of a comprehensive reputation mapping of the entire IPv4 address space is that any reverse naming exceptions are incorporated into the reputation values which also eliminates dependence on reverse DNS performance.

In IPv6, there can not be any pre-mapping.  This places reverse PTR review at the mercy of the even more broken IPv6 reverse zone provisioning.  Any mis-configuration of the reverse name space, which is common for IPv4 from residential systems, greatly increases the resources consumed by the growing proportion of sessions emitted by compromised systems.  Few expect reverse PTRs and hostnames to match, but to offer names not hinting at being for a dynamic assignment.  Greatly increased delays caused by DNS misconfiguration, along with a need to handle a larger number of sessions, will make testing reverse PTR records highly resource prohibitive and problematic for IPv6.

In the end, Reverse PTRs can be assigned any name and thus can not serve as a basis to assess accountability.  Once a conclusion is reached that only AUTHENTICATED initiating domains offer a means to fairly establish a basis for acceptance, use of reverse PTR records becomes far far less attractive.  The ability to authenticate forward domains initiating messages improves security and is better suited for a future of more mobile and dynamic infrastructure.

Many email domains will find themselves obligated to authorize IPv4 outbound servers using SPF.  Return-Path mail parameters locating authorization reduces backscatter abuse at the cost of reduced delivery integrity.  However this parameter's relationship over mail's entire path is too fragile to serve as a basis for acceptance.  Since DKIM allows any message to be relayed by design, it can not offer a means to mitigate abuse when any marginal domain must be accepted, as for domains considered too big to block.

In addition, problems related to DKIM header field spoofing permitted when signatures are still considered valid, along with a growing range of dangerous email content that references compromised i-frames, makes responding to new threats a growing problem.  IPv6 pushes this problem further over the edge without the introduction of the initiating domains having been authenticated.  IPv6 addresses can not serve this function, and there is progress being made in respect to use of DANE and the like.

Regards,
Douglas Otis

---

From: Douglas Otis <[email-masked]>
Date: Mon, 8 Apr 2013 21:18:21 -0700

On Mar 31, 2013, at 1:23 AM, Doug Barton <[email-masked]> wrote:

> On 03/30/2013 11:26 PM, Christian Huitema wrote:
> That only works insofar as the provider does not follow the standard recommendation to issue a /48. If they do, the abuser has 65k /64s to operate in.
> 
> What's needed is a little more intelligence about how the networks which the IPv6 addresses are located are structured. Similar to the way that reputation lists nowadays will black list a whole /24 if 1 or a few addresses within it send spam.
> 
> The problems are not insoluble, they're just different, and arguably more complex in v6. It's also likely that in the end more work on reputation lists will provide less benefit than it did in the v4 world. But that's the world we live in now.

Dear Doug,

Why aggregate into groups of 64k prefixes?  After all, this still does not offer a practical way to ascertain a granularity that isolates different entities at /64 or /48.  It is not possible to ascertain these boundaries even at a single prefix.  There is 37k BGP entries offering IPv6 connectivity.  Why not hold each announcement accountable and make consolidated reputation a problem ISPs must handle?  Of course, such an approach would carry an inordinate level of support and litigation costs due to inadvertent collateral blocking.  Such consolidation would be as impractical as would an arbitrary consolidation at /48.  

Prior traffic is required to review reverse DNS PTR records, which is resource intensive due to unavoidable delays.  Our IPv4 reputation services will not block entire /24s based upon a few detected abusive sources.  CIDR listings grow only after abuse exceeds half.   Even this conservative approach is problematic in places like China.  There are 4 million /64 prefixes for every possible IPv4 address .  Taking an incremental CIDR blocking approach still involves keeping track of a prefix space 4 million times larger than the entire IPv4 address space, where it is generally understood sharing the same IP address carries a risk.  Are you really suggesting that sharing the same /48 carries a similar risk?

The goal should be to avoid guesswork and uncertainty currently plaguing email.

v6 BGP announcement growth graph is published at: 
http://bgp.potaroo.net/v6/as2.0/

Regards,
Douglas Otis

---

From: joel jaeggli <[email-masked]>
Date: Mon, 08 Apr 2013 22:27:50 -0700

On 4/8/13 9:18 PM, Douglas Otis wrote:
>
> On Mar 31, 2013, at 1:23 AM, Doug Barton <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>>>> IPv6 makes publishing IP address reputations impractical.  Since IP 
>>>> address reputation has been a primary method for identifying 
>>>> abusive sources with IPv4, imposing ineffective and flaky > 
>>>> replacement strategies has an effect of deterring IPv6 use.
>>>
>>> In practice, the /64 prefix of the IPv6 address has very much the 
>>> same "administrative" properties as the /32 value of the IPv4 
>>> address. It should be fairly straightforward to update a reputation 
>>> system to manage the /64 prefixes of IPv6. This seems somewhat more 
>>> practical than trying to change the behavior of mail agent if their 
>>> connectivity happens to use IPv6.
>>
>> That only works insofar as the provider does not follow the standard 
>> recommendation to issue a /48. If they do, the abuser has 65k /64s to 
>> operate in.
>>
>> What's needed is a little more intelligence about how the networks 
>> which the IPv6 addresses are located are structured. Similar to the 
>> way that reputation lists nowadays will black list a whole /24 if 1 
>> or a few addresses within it send spam.
>>
>> The problems are not insoluble, they're just different, and arguably 
>> more complex in v6. It's also likely that in the end more work on 
>> reputation lists will provide less benefit than it did in the v4 
>> world. But that's the world we live in now.
>
> Dear Doug,
>
> Why aggregate into groups of 64k prefixes?  After all, this still does 
> not offer a practical way to ascertain a granularity that isolates 
> different entities at /64 or /48.  It is not possible to ascertain 
> these boundaries even at a single prefix.  There is 37k BGP entries 
> offering IPv6 connectivity.  Why not hold each announcement 
> accountable and make consolidated reputation a problem ISPs must 
> handle?  Of course, such an approach would carry an inordinate level 
> of support and litigation costs due to inadvertent collateral 
> blocking.  Such consolidation would be as impractical as would an 
> arbitrary consolidation at /48.
>
Plently of people use IP to ASN mappings as part of their input for 
reputation today.
> Prior traffic is required to review reverse DNS PTR records, which is 
> resource intensive due to unavoidable delays.  Our IPv4 reputation 
> services will not block entire /24s based upon a few detected abusive 
> sources.  CIDR listings grow only after abuse exceeds half.   Even 
> this conservative approach is problematic in places like China.  There 
> are 4 million /64 prefixes for every possible IPv4 address .  Taking 
> an incremental CIDR blocking approach still involves keeping track of 
> a prefix space 4 million times larger than the entire IPv4 address 
> space, where it is generally understood sharing the same IP address 
> carries a risk.  Are you really suggesting that sharing the same /48 
> carries a similar risk?
>

---

From: Douglas Otis <[email-masked]>
Date: Tue, 9 Apr 2013 10:19:24 -0700

On Apr 8, 2013, at 10:27 PM, joel jaeggli <[email-masked]> wrote:

>> On Mar 31, 2013, at 1:23 AM, Doug Barton <[email-masked] <mailto:[email-masked]>> wrote:
>> 
> Plently of people use IP to ASN mappings as part of their input for reputation today.

Dear Joel,

Unfortunately, ISPs are bad at responding to email abuse complaints.  There are exceptions where reputation needs to be escalated to the ASN, as was the case in Brazil which then involved litigation.  You're welcome, but operations at that level will not scale and might lead to balkanization.

With respect to IPv6 granularity, there is only ~7k ASNs.  As IPv6 adoption increases, this should approach 37k.  In addition, there are more /32 prefixes than /48.  Each /32 represents a span greater than the entire IPv4 Internet.  The network covered by each prefix represents an address span IPv4 squared in size.  The sparse nature of abuse and the size of IPv6 prefix space makes collecting evidence and distributing detected abuse by IP address or prefix both expensive and slow, where any IP address query mechanism is likely to result in self inflicted DDoS. 

If email offered authentication of the sourcing domain or that of a domain certificate, then reputation could be fairly applied and easily distributed. This ability is essential for IPv6.

Regards,
Douglas Otis