Re: [CGA-EXT] Hashed DAD

El 29/02/2008, a las 10:59, Iljitsch van Beijnum escribió:

> On 29 feb 2008, at 7:06, marcelo bagnulo braun wrote:
>
>> Actually, i think that there would be possible a simpler mechanism to
>> achieve similar level of protection with a similar cost to the one
>> that is being proposed by Pars, and it is basically veryfying that  
>> the
>> address corresponds to the CGA PDS contained in the  CGA option
>> defined by SeND.
>
> [...]
>
> Wouldn't this be vulnerable to bidding down attacks? The malicious  
> host could just claim to not understand the new options.
>

but this is already the case in all the send protocol
i mean, in order to enable backward compatibility you need to deal  
with hosts that don't understand the protocol and then you may have  
bidding down attacks. The solution for this is that the host need to  
figure out what to do. Either it only believes send messages and is  
secure but may not be able to communicate with legacy nodes or it does  
trust non send messages and he may be vulnerable to bidding down  
attacks (At least that how i understand this, please correct me if i  
am wrong)

> Also, wouldn't a host that claims to have an address be right by  
> definition? I.e., If I want to prevent you from using your new  
> address, I can simply configure the same address and this will  
> certainly confuse the link layer enough to make it very hard for you  
> to use the address, even if SEND can help you "defend" it against  
> network layer attacks.

but in this case, the host can protect itself by only accepting send  
protected messages

>
>
> Maybe a useful heuristic would be to trust the first 3 DAD failures  
> with a node with a given link layer address and after that, simply  
> ignore DAD failures with that link layer address.

or only trust send protected messages

regards, marcelo

> Either the node holding that link layer address is just targeting  
> DAD and you'll be able to use the address, or they're really out to  
> get you at layer 2 and no amount of DAD is going to help.

_______________________________________________
CGA-EXT mailing list
CGA-EXT@ietf.org
https://www.ietf.org/mailman/listinfo/cga-ext