Subject: RE: [v6ops] Re: Improving ND security

From: "Templin (US), Fred L" <[email-masked]>
Date: Mon, 3 Aug 2020 18:36:15 +0000

Hi Ed,

> Hi Fred,
> SEND assumes RSA "RSASSA-PKCS1-v1_5  algorithm and SHA-1 hash" that is good enough for majority of purposes.
> Currently Elliptic-curve cryptography is more popular, but it is not mandatory - RSA is good enough.
> 
> Teredo specification assumes that "authentication algorithm, shared with the server", "agreed-upon authentication algorithm".
> Hence, it is not possible to tell exactly how secure it is.
> But because by default "To maximize interoperability, this specification defines a default algorithm in which the authentication value is
> computed according the HMAC specification [RFC2104] and the SHA1 function [FIPS-180]."
> We could say that it is much weaker then SEND, because HMAC in principle is much weaker then open key cryptography (RSA).

Thanks for this well-balanced note. If we consider just the cryptographic strength
of the security algorithms, then I don't mind going with SEND even though it means
also bringing along CGAs. I still have yet to understand how CGA is anything other
than a useless bag of bits for the purposes of OMNI, but if we have to carry along
CGAs we will. 

> And we are comparing orange to apple here, because
> - SEND is used for neighbor authentication
> - Teredo is the tunnel
> They have different purpose in networking.

The intention for OMNI is that the usage would be for one and the same purpose.
So, we have a tradeoff between quick-and-dirty for RFC4380 vs thorough-and-detailed
for SEND/CGA. Maybe Christian can tell us if quick-and-dirty is good enough - or maybe
he already has??

Thanks - Fred

> Eduard
> -----Original Message-----
> From: v6ops [mailto:[email-masked]] On Behalf Of Templin (US), Fred L
> Sent: 3 августа 2020 г. 20:20
> To: Christian Huitema <[email-masked]>; Fernando Gont <[email-masked]>
> Cc: 6man <[email-masked]>; v6ops list <[email-masked]>
> Subject: Re: [v6ops] [EXTERNAL] Re: Improving ND security
> 
> Christian,
> 
> > -----Original Message-----
> > From: Christian Huitema [mailto:[email-masked]]
> > Sent: Monday, August 03, 2020 10:02 AM
> > To: Fernando Gont <[email-masked]>
> > Cc: Templin (US), Fred L <[email-masked]>; Pascal Thubert
> > (pthubert) <[email-masked]>; v6ops list <[email-masked]>; 6man
> > <[email-masked]>
> > Subject: Re: [v6ops] [EXTERNAL] Re: Improving ND security
> >
> > This message was sent from outside of Boeing. Please do not click
> > links or open attachments unless you recognize the sender and know that the content is safe.
> >
> > > On Aug 3, 2020, at 9:35 AM, Fernando Gont <[email-masked]> wrote:
> > >
> > > On 3/8/20 11:22, Templin (US), Fred L wrote:
> > >> ...
> > >
> > >
> > >
> > >> But then, RFC4380 offers a “poor-man’s” alternative to SEND/CGA. It
> > >> places a message authentication code in the encapsulation
> > headers of IPv6 ND messages so that the messages can pass a rudimentary authentication check.
> > >
> > > You mean the Teredo spec? If so, I don't think it includes any sort of poor-man's SEND-CGA.
> >
> > Configuration mistakes were a big concern during the design of Teredo,
> > and that's a reason why Teredo embeds continuity tests. But these tests will not resist an on-path attacker, let alone an on-link
> attacker.
> 
> 
> 
> What has been the experience with RFC4380 security in-the-wild? Is it considered "secure enough" out of the box? Or, if you had to
> do it again would you incorporate something "more secure" like SEND/CGA?
> 
> Thanks - Fred
> 
> 
> > -- Christian Huitema
> 
> _______________________________________________
> v6ops mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/v6ops