[cgasec] To your health, and a comment on strength

[Christian Huitema <[e-mail]>]

Santé! I hope you will enjoy the bar's offerings. I will not be able to join you, but I wish you luck. CGA have the potential for providing address authentication without relying on certification authority, and that's certainly valuable. Having a standard way to "prove it" is also commendable. I am sure that there will be debates on the general architecture. Instead of using IPv6 options, one could think of out of band mechanisms like ICMP, application layer challenges, or extensions to existing protocols like IKE or SSL. Also, there is no little value in authenticating the source address of a packet if the content or destination can be tampered with, so CGA can only be a piece of the puzzle. But this is not the point of my mail. I would like to discuss strength, and specifically the 2**59 issue.

The draft correctly states that the "cryptographic strength of CGA addresses makes it 2**59 times harder to forge an address than to generate a new address." But the cost of generating new addresses can be made arbitrarily harder by the "Security Parameter" and "Hash Extension" mechanism of RFC 3972. The draft does not mention it. I believe it should.

The Security Parameter is defined in RFC 3972 as three bits that define increasing difficulty of address generation, and ipso facto increasing difficulty of address spoofing. Access control lists can easily be restricted to only include addresses generated with the appropriate values of the CGA Security parameter. This will force users of a protected service to generate CGA with appropriate strength. I believe this type of restriction should be documented in the security consideration.

In the interest of full disclosure, I need to point out Microsoft's IPR statement about CGA: https://datatracker.ietf.org/ipr/676/. 

-- Christian Huitema