RE: Scripting attacks [was Next step for draft-ietf-6man-rfc6874bis]

But passive scanner should be on the promiscuous port (receive all traffic, or at least all multicast traffic) which would be a challenge for the attacker.
Hence, the sweep ping (active) assumption here.
Ed/
From: ipv6 [mailto:ipv6-bounces@ietf.org] On Behalf Of Kerry Lynn
Sent: Thursday, June 30, 2022 5:19 PM
To: Carsten Bormann <cabo@tzi.org>
Cc: Stuart Cheshire <cheshire@apple.com>; 6man <ipv6@ietf.org>; Bob Hinden <bob.hinden@gmail.com>
Subject: Re: Scripting attacks [was Next step for draft-ietf-6man-rfc6874bis]

On Thu, Jun 30, 2022 at 12:45 AM Carsten Bormann <cabo@tzi.org<mailto:cabo@tzi.org>> wrote:
On 30. Jun 2022, at 06:40, Brian E Carpenter <brian.e.carpenter@gmail.com<mailto:brian.e.carpenter@gmail.com>> wrote:
>
> For the present draft, one thing my small experiment shows is that we won't make things worse by adding zone identifiers to URLs. They too have to be guessed by the attacker, and in modern Linux they are things like "enxb813ebc170a4" out of the box. That makes the attacker's job significantly harder.

Do you know how enxb813ebc170a4 is generated?  (I.e., is the 48-bit thing in there guessable?)

I think I agree with the conclusion (at least, that it is quite hard/costly/lengthy to mount an attack based on this), but I think that it would be good to get a clean argument for that in the security considerations.
Is it sufficient to say there are easier ways to gather LL host addresses?

Maybe I'm missing something, but for LL address scanning mustn't the attacker
already be on the link? Isn't it simpler to deploy a passive scanner and just glean
active LL addresses?

Note there are 6lo data links (e.g. RFC 8163) where SLAAC address construction
is done with many fewer than 48 bits. My argument there was to use 64-bit opaque
IDs for globally-routable addresses, but short IDs for LL addresses to make better
use of header compression. I didn't state the latter recommendation was also
because I felt sniffing on the link was trivial.

See also RFC 8605, where I encouraged Dave Thaler to distinguish between on-
and off-link attacks.

Kerry

Grüße, Carsten

--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6@ietf.org<mailto:ipv6@ietf.org>
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------