Re: SEND IDs [Re: Comments on draft-nordmark-multi6-threats-01]

[Jari Arkko <jari.arkko@piuha.net>]

Iljitsch van Beijnum wrote:

> I think there was some confusion about all of this on the SEND list, as 
> this was never the approach I advocated, as this makes everything more 
> complex which is never good in general and especially in the area of 
> security.

Its possible that me (or others) did not fully understand
what you wanted. Please allow also for the possibility that
us SENDers have studied the security issues and have a
technical reason why the prefix is included. Or that we
have a different opinion than you have about the privacy
issues.

> What I wanted was to allow the use of any on-link prefix in the CGA 
> generation. So if a link has prefixes A and B, and a host generates a 
> CGA interface identifier using prefix A, the host gets to use this same 
> interface identifier to create an address with prefix B. I don't see how 
> this hurts anyone who isn't interested in this, but it would allow 
> switching prefixes and maintaining the lower 64 bits without breaking 

Ah, this was indeed different from what I had understood.
Thanks for the clarification.

This proposal is better than the other one, because I think
we could provide a backwards compatible extension to SEND
that allows for this style, by using the CGA Parameters
extension to report the prefix A.

However, I am not convinced -- yet at least -- that the
proposal is secure. I feel uneasy with the thought that
someone (say, the NSA) could construct a precomputed table
of 2^62 CGA addresses for prefix A, and all that would
be needed to take over an address from B::<any IID> would
be to claim that A is "on-link". It does not immediately
follow that the scheme is broken, because we do have
security for prefix advertisements as well. But it is
an additional worry that I, at least, would rather spend
some time analysing rather than adopting it because it
might be needed if solution 7/32 is chosen in multi6 :-)

> CGA. Still, we don't know if that's something that's required, so the 
> whole thing may turn out to be moot anyway when we decide on a multi6 
> mechanism.

Yes. My suggestion is that you work it out in multi6 WG first, and
if you come up with a solution that needs an extension or a change
to the SEND specifications, we can talk about it at that time.

By the way, would DHCP work with the same-IID solution?

--Jari