[6tisch-security] address to use for Join Proxy
Michael Richardson <mcr+ietf@sandelman.ca> Fri, 10 March 2017 03:24 UTC
Return-Path: <mcr+ietf@sandelman.ca>
X-Original-To: 6tisch-security@ietfa.amsl.com
Delivered-To: 6tisch-security@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EE88912957F for <6tisch-security@ietfa.amsl.com>; Thu, 9 Mar 2017 19:24:52 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id A9No3PxgxSSz for <6tisch-security@ietfa.amsl.com>; Thu, 9 Mar 2017 19:24:51 -0800 (PST)
Received: from tuna.sandelman.ca (tuna.sandelman.ca [IPv6:2607:f0b0:f:3:216:3eff:fe7c:d1f3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6DCCD129519 for <6tisch-security@ietf.org>; Thu, 9 Mar 2017 19:24:51 -0800 (PST)
Received: from sandelman.ca (obiwan.sandelman.ca [209.87.249.21]) by tuna.sandelman.ca (Postfix) with ESMTP id 8684320564 for <6tisch-security@ietf.org>; Thu, 9 Mar 2017 19:11:59 -0500 (EST)
Received: from obiwan.sandelman.ca (localhost [IPv6:::1]) by sandelman.ca (Postfix) with ESMTP id A22B76381A for <6tisch-security@ietf.org>; Thu, 9 Mar 2017 18:49:12 -0500 (EST)
From: Michael Richardson <mcr+ietf@sandelman.ca>
To: 6tisch-security@ietf.org
X-Attribution: mcr
X-Mailer: MH-E 8.6; nmh 1.6+dev; GNU Emacs 24.5.1
X-Face: $\n1pF)h^`}$H>Hk{L"x@)JS7<%Az}5RyS@k9X%29-lHB$Ti.V>2bi.~ehC0; <'$9xN5Ub# z!G,p`nR&p7Fz@^UXIn156S8.~^@MJ*mMsD7=QFeq%AL4m<nPbLgmtKK-5dC@#:k
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="=-=-="; micalg="pgp-sha256"; protocol="application/pgp-signature"
Date: Thu, 09 Mar 2017 18:49:12 -0500
Message-ID: <3836.1489103352@obiwan.sandelman.ca>
Archived-At: <https://mailarchive.ietf.org/arch/msg/6tisch-security/n1K2c1vwrDXBg5k4L_F_CLwoxEE>
Subject: [6tisch-security] address to use for Join Proxy
X-BeenThere: 6tisch-security@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Extended Design Team for 6TiSCH security architecture <6tisch-security.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/6tisch-security>, <mailto:6tisch-security-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/6tisch-security/>
List-Post: <mailto:6tisch-security@ietf.org>
List-Help: <mailto:6tisch-security-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/6tisch-security>, <mailto:6tisch-security-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 10 Mar 2017 03:24:53 -0000
One of the constraints about using the IPIP proxy method is that the Join Proxy has to advertise/coordinate the same IP address. That is, the JRC needs to have a LL address configured which the Join Proxy advertises as the target. This is so that the UDP/TCP state is correct. One possible way to deal with this is to use a well-known anycast LL address. It looks easy to ask IANA to allocate one. https://bitbucket.org/mcr314/draft-ietf-6tisch-minimal-security/commits/bf3646fa7555dcb620fa8e9e153d9850ec5e75d6 +A pledge finds the layer-2 address of the Join Proxy by looking at the +EUI64 source address of enhanced beacons it has received that have the +Network ID extension, and have the Join Proxy bit set. +The Layer-3 address is the anycast address TBD1. + +The pledge need not do ND for the Join Proxy (which requires an expensive multicast), +but rather can form the layer-2 address directly from the EUI-64 that was seen. + +The pledge uses it's link-local address when speaking to the JRC via the Join Proxy. + https://bitbucket.org/mcr314/draft-ietf-6tisch-minimal-security/commits/af518a119d81ef52d217088ad16d6c91183c3874 +This document allocates the address TBD1 from the +Internet Protocol Version 6 (IPv6) Anycast Addresses registry. + +https://www.iana.org/assignments/ipv6-anycast-addresses/ipv6-anycast-addresses.xhtml -- Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works -= IPv6 IoT consulting =-
- [6tisch-security] address to use for Join Proxy Michael Richardson