Subject: RE: ndproxy and SEND

From: "Christian Huitema" <[email-masked]>
Date: Tue, 2 Mar 2004 18:00:37 -0800

ND proxy is the equivalent of ARP spoofing.
SEND is the antidote to ARP spoofing.
Why should we be surprised that they are not compatible?

-- Christian Huitema

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Fred Templin <[email-masked]>
Date: Tue, 2 Mar 2004 18:05:33 -0800 (PST)

All right then; I know what SEND is good for, so tell me what
ND proxy is good for (if what you are saying is true)?
 
Thanks - Fred
[email-masked]

Christian Huitema <[email-masked]> wrote:
ND proxy is the equivalent of ARP spoofing.
SEND is the antidote to ARP spoofing.
Why should we be surprised that they are not compatible?

-- Christian Huitema

---

From: "James Kempf" <[email-masked]>
Date: Tue, 2 Mar 2004 18:41:56 -0800

Christian,

At one level, I agree with you. But I do think it would be possible to
provide security for proxy ND (having thought about the issue a bit and even
written something on it that I did not publish), but I believe it would take
stronger security than is currently in SEND for ND. One obvious approach
would be to require a third party trust root, like RD in SEND already does.
But there might be others.

            jak

----- Original Message ----- 
From: "Christian Huitema" <[email-masked]>
To: "Fred Templin" <[email-masked]>; "James Kempf"
<[email-masked]>; "Erik Nordmark" <[email-masked]>; "Dave
Thaler" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, March 02, 2004 6:00 PM
Subject: RE: ndproxy and SEND

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 2 Mar 2004 20:56:14 -0800 (PST)

> Why should we be surprised that they are not compatible?

Agreed.

Question is what we should do about it.
Having two conflicting things move forward towards the standards track
doesn't seem like the best solution.

  Erik

---

From: Jari Arkko <[email-masked]>
Date: Wed, 03 Mar 2004 07:01:14 +0200

In general, I think proxy SEND is doable, and doesn't even need
any new trust roots or anything. Its a question of delegating
the right to do advertisements for someone else. The protocol
details are left as an exercise for the reader ;-).

However, I can see different use cases and we can use the
secure version only in some cases. For instance, you could
be proxying ND because you are a home agent and defending
a mobile node's home address on its behalf. Or you could be
proxying ND because of some link layer bridging scheme.

Now, for the delegation that I mentioned above to work, there
has to be some kind of (security) relationship between the real
node and the proxy. There would be such a relationship in the
case of Mobile IP, for instance. But it isn't clear that you
would always have it in the bridging case -- typically there's
no security association with the bridge! But you might be able
to do this securely if you had layer 2 security from the node
to the bridge.

--Jari

---

From: "James Kempf" <[email-masked]>
Date: Tue, 2 Mar 2004 21:47:36 -0800

> doesn't seem like the best solution.

So following up on Jari's note, I think it depends on what the ND-Proxy
draft is intended for. If it is intended primarily for link layer boxes,
then there isn't much one can do about securing it outside of specifying
that it should only be used on secure link layers. In that case, it seems
like putting such a statement in the Security Considerations section might
be a possibility. On the other hand, if ND-Proxy is intended for IP layer
entities such as a Mobile IP home agent, then we could continue working on
ND proxy security in SEND, or it could be taken up specifically by the IPv6
WG.

            jak