Subject: [rbridge] RBridges and SEND/CGA

From: Donald.Eastlake at motorola.com (Eastlake III Donald-LDE008)
Date: Wed Jan 26 21:10:17 2005

Ahhh, you are correct. All the secured messages use a nonce or
Timestamp.

Thanks,
Donald

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Erik Nordmark
Sent: Wednesday, January 26, 2005 6:09 PM
To: Developing a hybrid router/bridge.
Subject: Re: [rbridge] RBridges and SEND/CGA

Eastlake III Donald-LDE008 wrote:
> One advantage of RBridges is that, with IP optimizations, they can do
> proxy ARP greatly reducing ARP flooding. I was thinking about whether
> this also applies to signed Neighbor Discovery messages in IPv6.
> Seems to me that it does.
> 
> In particular, if you pass along in the link state message not only
> MAC addresses but also the corresponding IP addresses and ND
> signatures, then the RBridges can do proxy ND and greatly reduce ND
> flooding the same way they can reduce ARP flooding. So it seems very
> simple to do.

SeND has replay protection for solicited information (NA as a result of 
a NS, RA as result of a RS) that uses nonces if I'm not mistaken.
Since the nonce is protected by the signature, the rbridge can't replay 
a NA/RA in response to a NS/RS, since it would be detected.
(I think the unsolicited information uses a time stamp instead, which 
allows for some amount of caching and replay by an rbride).

But the packets still don't need to be flooded across the whole topology 
since the first rbridge in the path can send the packet to the last 
rbridge in the path, so that the host can respond.

   Erik
_______________________________________________
rbridge mailing list
[email-masked]
http://www.postel.org/mailman/listinfo/rbridge