Subject: RE: I-D Action: draft-jiang-6man-cga-sec-option-00.txt

From: Hosnieh Rafiee <[email-masked]>
Date: Mon, 7 Jul 2014 09:56:14 +0000

Hi,
I've read this document and I have some questions
It was for purpose that in CGA document, they used 3 bits sec values as a part of an IP address. However, based on the current CGA specification document, this value has been ignored during the verification process and that was the result that I wrote
http://tools.ietf.org/html/draft-rafiee-6man-cga-attack-01
But when you add new option but not a part of a CGA IP address, then the attack explained in my document can be applicable like with current CGA specification document. In other words, the attacker easily can try to match different CGA sec values with the CGA value of the legitimate node. 

So, I guess you need to somehow protect CGA from this attack.

Best,
Hosnieh 

-----Original Message-----
From: I-D-Announce [mailto:[email-masked]] On Behalf Of [email-masked]
Sent: Friday, July 04, 2014 9:55 AM
To: [email-masked]
Subject: I-D Action: draft-jiang-6man-cga-sec-option-00.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.

        Title           : CGA SEC Option for Secure Neighbor Discovery Protocol
        Authors         : Sheng Jiang
                          Dacheng Zhang
                          Suresh Krishnan
	Filename        : draft-jiang-6man-cga-sec-option-00.txt
	Pages           : 5
	Date            : 2014-07-04

Abstract:
   A Cryptographically Generated Address is an IPv6 addresses binding
   with a public/private key pair.  It is a vital component of Secure
   Neighbor Discovery (SeND) protocol.  The current SeND specifications
   are lack of procedures to specify the Sec bits.  A new SEC option is
   defined accordingly to address this issue.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-jiang-6man-cga-sec-option/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-jiang-6man-cga-sec-option-00

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

_______________________________________________
I-D-Announce mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

---

From: "Zhangdacheng (Dacheng)" <[email-masked]>
Date: Fri, 1 Aug 2014 02:42:54 +0000

Hi, Hosnieh:

I think you talking about a issues in the CGA specification rather than in our document. You are indicating if the sec value is checked during the verification process, this issues will no longer exist, right? Correct me if I misunderstood anything. ^_^

Cheers

Dacheng

> From: ipv6 [mailto:[email-masked]] On Behalf Of Hosnieh Rafiee
> Sent: Monday, July 07, 2014 5:56 PM
> To: [email-masked]
> Subject: RE: I-D Action: draft-jiang-6man-cga-sec-option-00.txt
> 
> Hi,
> I've read this document and I have some questions It was for purpose that in
> CGA document, they used 3 bits sec values as a part of an IP address. However,
> based on the current CGA specification document, this value has been ignored
> during the verification process and that was the result that I wrote
> But when you add new option but not a part of a CGA IP address, then the
> attack explained in my document can be applicable like with current CGA
> specification document. In other words, the attacker easily can try to match
> different CGA sec values with the CGA value of the legitimate node.
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Draft directories: http://www.ietf.org/shadow.html or
> ftp://ftp.ietf.org/ietf/1shadow-sites.txt
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------