Subject: RE: Request to Advance: <draft-ietf-ipv6-ndproxy-00.txt> [RESEND]

From: "Christian Huitema" <[email-masked]>
Date: Tue, 1 Feb 2005 23:45:46 -0800

> ... I spoke to the NOC about it, and found out that they had only
> allocated enough address space for 256 hosts, and there were well over
300
> people in the room, many of whom were knowledgable networking
researchers.
> Somebody was ARP spoofing, stealing addresses because not enough had
been
> allocated. ARP spoofing is one of the threats SEND is designed to
counter,
> so if IPv6/SEND had been deployed, this attack would not have been
> possible.

If IPv6 had been deployed, the router would have announced a /64, and
there would have been addresses available for everybody...

> ... (and this is a particular problem for 802.11
> because the management frames are completely unprotected). The spoofer
> cannot, however, claim frames holding packets having your IP address
if
> SEND
> is used, because the mapping is protected. 

The mapping is protected but, unless the network implements 802.1X and
negotiates different keys for each station, the attacker has no
difficulty getting a copy of your packets, or sending packets from a
spoofed MAC address.

Don't get me wrong, I like SEND. My point was just that if we allow
"transparent" bridges at all, then we essentially allow the same
man-in-the-middle attacks that are also possible with ND proxy.

-- Christian Huitema

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Erik Nordmark <[email-masked]>
Date: Wed, 02 Feb 2005 09:51:44 -0800

> man-in-the-middle attacks that are also possible with ND proxy.

But doesn't the layering inherent in the SeND vs. IEEE make this rather 
different in practice than ndproxy?

With SeND in hand, the user can deploy IEEE technologies (whether .1x 
with MAC address somehow bound to the authenticated user, or future 
things - .16 talks of certificates bound to MAC addresses I think).

Once the user deploys both, then the resulting system is secure, with 
SeND protecting the mapping between IP and L2 address, and IEEE protocol 
protecting the mapping between L2 address and authenticated "user".
The user can even use IEEE 802.1D bridges in the part of the network 
that is physically secured (i.e., where no clients can connect) without 
loss of security.

Can the user accomplish the same if ndproxy is used?
The applicability of ndproxy seems to be towards the "edge" of the link 
i.e. to allow extensions of a single /64. Doesn't that mean that it 
would be natural for it to be deployed outside of the "trusted wiring 
closet" when the user keeps their 802.1D bridges?

    Erik