Subject: First Come First Serve - does it work?

From: Vasilenko Eduard <[email-masked]>
Date: Thu, 1 Oct 2020 11:58:53 +0000

Hi Pascal,
There is one difference between my draft and SAVI.
Server could go to reload for upgrade or maintenance.
Intruder could claim his IP address at that time.
Then Intruder would ask all Enterprise users for passwords...
And he would be capable to proxy traffic to server's different IP address.
Look to small section 5.3 of my draft - it is explained there.

I would not say that it is extremely big difference, but anyway - my draft is more secure.
Both (legal server and Intruder) would be blocked - address would be just blocked. Administrator should be involved.

FCFS is the problem for any ND without authentication. Including WiND.
Ed/
> -----Original Message-----
> From: Pascal Thubert (pthubert) [mailto:[email-masked]]
> Sent: 1 октября 2020 г. 14:37
> To: Fernando Gont <[email-masked]>; Vasilenko Eduard
> <[email-masked]>; Fernando Gont <[email-masked]>;
> Xipengxiao <[email-masked]>; [email-masked]
> Subject: RE: New draft-vasilenko-6man-nd-mitm-protection-00.txt
> 
> Hello Fernando
> 
> > >> If you consider RA-guard a mitigation for RA-based attacks, then,
> > >> things like "First Hop Security"/ND inspection/SAVI would solve the
> > >> ND
> > counterpart.
> > > I have not understood what you mean by "First Hop Security"/ND inspection"
> > - it looks as very general term.
> >
> > See e.g.:
> > https://www.cisco.com/c/en/us/td/docs/ios-
> > xml/ios/ipv6_fhsec/configuration/15-sy/ip6-nd-inspect.html
> 
> As you point out, this 10 years-old approach mitigates ND attacks including the
> ones addressed here.  It's interesting that 20 years old problems keep
> resurfacing in new drafts. The world has moved on and 6MAN was left behind.
> 
> Still you'll find that we do a number of internal tricks, inclusion transformations
> of the frames and "intelligent" frame drops, that were not discussed / validated
> by the community. This yields its own dangers so yes, it's not an ideal situation. I
> know, I wrote a good deal of that code.
> 
> ND inspection is based in snooping and would benefit from a real interface with
> the host. We saw that in the GRAND discussion, another trick like the one
> proposed because the base ND is outdated. How many till this group wakes up?
> 
> Now, there is second chance to reconciliate the needs of the real world and the
> work at 6MAN. We all know what shape ND needs to have in a modern
> managed network. And it's not reactive.
> 
> Keep safe;
> 
> Pascal
>

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Thu, 1 Oct 2020 12:19:56 +0000

Hello Eduard

As a so called sleeping proxy, the infrastructure can protect the ownership of the address while the node is sleeping. It's just an optional behavior. To do it right, the host should ask for a protection associated with a duration.

An example of how that can be realized is:

- use RFC 8505 to ask for the proxy protection for the duration indicated in the EARO 
- use https://datatracker.ietf.org/doc/draft-ietf-6lo-ap-nd to prove the SAVI ownership and repel an impersonator

More on the proxy operation in https://datatracker.ietf.org/doc/draft-ietf-6lo-backbone-router/

Keep safe

Pascal

> From: Vasilenko Eduard <[email-masked]>
> Sent: jeudi 1 octobre 2020 13:59
> To: Pascal Thubert (pthubert) <[email-masked]>
> Cc: [email-masked]
> Subject: First Come First Serve - does it work?
> 
> Hi Pascal,
> Both (legal server and Intruder) would be blocked - address would be just
> blocked. Administrator should be involved.
> 
> > > >> things like "First Hop Security"/ND inspection/SAVI would solve
> > > >> the ND
> > > counterpart.
> > As you point out, this 10 years-old approach mitigates ND attacks
> > including the ones addressed here.  It's interesting that 20 years old
> > problems keep resurfacing in new drafts. The world has moved on and 6MAN
> was left behind.
> >
> > Still you'll find that we do a number of internal tricks, inclusion
> > transformations of the frames and "intelligent" frame drops, that were
> > not discussed / validated by the community. This yields its own
> > dangers so yes, it's not an ideal situation. I know, I wrote a good deal of that
> code.
> >
> > ND inspection is based in snooping and would benefit from a real
> > interface with the host. We saw that in the GRAND discussion, another
> > trick like the one proposed because the base ND is outdated. How many till
> this group wakes up?
> >
> > Now, there is second chance to reconciliate the needs of the real
> > world and the work at 6MAN. We all know what shape ND needs to have in
> > a modern managed network. And it's not reactive.
> >
> > Keep safe;
> >
> > Pascal
> >