Subject: Does NDP still in use

From: Hosnieh Rafiee <[email-masked]>
Date: Sun, 25 Dec 2016 20:17:22 +0100

Hi,

Actually it's a long time I am not actively involving in this group. so
I completely lost the track of IETF groups. My question is that, does
NDP still active and in use or it is no longer a recommended protocol
because of several old-well-known security problems?

Thanks,

Best,

Hosnieh

---

From: Erik Kline <[email-masked]>
Date: Mon, 26 Dec 2016 07:01:39 +0900

If by NDP you mean "Neighbor Discovery Protocol", then: yes, it is
still very much in use.

On 26 December 2016 at 04:17, Hosnieh Rafiee <[email-masked]> wrote:
> Hi,
>
>
> Actually it's a long time I am not actively involving in this group. so I
> completely lost the track of IETF groups. My question is that, does NDP
> still active and in use or it is no longer a recommended protocol because of
> several old-well-known security problems?
>
>
> Thanks,
>
> Best,
>
> Hosnieh
>
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>

---

From: Hosnieh Rafiee <[email-masked]>
Date: Mon, 26 Dec 2016 22:02:49 +0100

Thanks Erik

and is there any new approach to secure it or still folks think that
local network does not need any protection as it is considered trustee?

---

From: Michael Richardson <[email-masked]>
Date: Mon, 26 Dec 2016 19:25:33 -0500

> local network does not need any protection as it is considered trustee?

The WG has been aware of the issues on the local network (remember that SEND
was in fact created), and to date, the solutions cost more than what have
been (up to now, knock on wood) theoretical threats.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Hosnieh Rafiee <[email-masked]>
Date: Tue, 27 Dec 2016 10:20:39 +0100

Hallo Michael,

Thanks for the update. I am hopping that the WG again take this problem
serious. maybe you think in an enterprise network this is a theoretical
attack but not when all smart devices and also automotives use IPv6
which all the communication will be also in local network. then it is no
fun when an attacker can cause a serious danger to human life only
because SeND is not practical (expensive computation) . We need good
alternatives....

Best,

Hosnieh

---

From: joel jaeggli <[email-masked]>
Date: Tue, 27 Dec 2016 08:27:29 -0800

> because SeND is not practical (expensive computation) . We need good

Unfortunately there are not a lot of solutions in the L2 domain at the
protocol level that can totally isolate the hostile actor.

variously you can engage in snooping, as with arp, nd, ra-guard, dhcp
dhcpv6, igmp and so on.

Or more pure host isloation approaches such a private vlans,  wireless
client isolation, and their tunneled or overlay equivlanents.

pure admission controls tend to below IP, e.g. 802.1x.

The logical end of that is all ports are L3 ports at which point ND/arp
becomes rather less interesting and extremely  easy to reason about,, as
it is on point-to-point links.

---

From: Mikael Abrahamsson <[email-masked]>
Date: Tue, 27 Dec 2016 18:15:01 +0100 (CET)

> protocol level that can totally isolate the hostile actor.

https://tools.ietf.org/wg/savi/

I thought SAVI had solutions to most of these problems? I know very few 
care about SAVI, but still...

> variously you can engage in snooping, as with arp, nd, ra-guard, dhcp

Yes, exactly what SAVI handles.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Joel Jaeggli <[email-masked]>
Date: Tue, 27 Dec 2016 09:44:52 -0800

Sent from my iPhone

> On Dec 27, 2016, at 09:15, Mikael Abrahamsson <[email-masked]> wrote:
> 
> I thought SAVI had solutions to most of these problems? I know very few care about SAVI, but still...

I kinda assumed that would be snooping. FCFS approaches may keep hosts from spoofing each other but no some of the other things you can get up to unless client isolation is also part of the deal.

Of course on the same subnet is a place where end systems actually do want to communicate with each other for reasons of convenience  which makes isolation less desirable in for example one's house

---

From: "Ole Troan (otroan)" <[email-masked]>
Date: Tue, 27 Dec 2016 17:59:15 +0000

> On 27 Dec 2016, at 17:27, joel jaeggli <[email-masked]> wrote:
> 

Indeed. Problem solved. 

O.

---

From: Hosnieh Rafiee <[email-masked]>
Date: Fri, 30 Dec 2016 17:51:30 +0100

Thanks a lot Joel and Michael,
> it is on point-to-point links.
This will not work with anonymous networks. In other word, the networks
that there are many nodes join and leave and there is  light
authentication approach to join the network. so attacker can also join
such network.

I am not talking about the smart home network that one might have more
control over the nodes but networks of things (that can be anything) in
a big smart cities.....

---

From: joel jaeggli <[email-masked]>
Date: Fri, 30 Dec 2016 09:42:11 -0800

> authentication approach to join the network. so attacker can also join

I think you're making an unstated assumption about the architecture of
the network you'e describing. Indeed, if  at this point the design of a
network does not include recourse to methods that can reduce the
effectiveness of bad actors then that network is probably not suitable
to a task that assumes the existence of bad actors (probably this is a
tautology).

Hosts through various forms of trust anchors reduce their reliance on
being able to trust local resources being free of hostile actors,
whether this is dnssec / certificate pinning / local keyrings /
construction of overlays and so on, it reduces reliance on the
local-network and intermediate transport being trustworthy. If you move
up the stack you'll find applications that don't trust the host they run
on or the other applications present on systems which further engage in
such activities (consider the implementation of a full network stack in
facebook clients for example).

> control over the nodes but networks of things (that can be anything) in

Given the extent to which devices in home networks have the potential to
be subverted, I'm not sure that I would hold up the home network as an
example of a place where a great deal of control is in place or that the
actors found there are terribly trustworthy.