Re: IPv6 header insertion in a controlled domain

[Gyan Mishra <[e-mail]>]

On Sun, Dec 8, 2019 at 12:12 PM Gyan Mishra <[e-mail]> wrote:

>
>
> On Sun, Dec 8, 2019 at 11:24 AM <[e-mail]> wrote:
>
>> Gyan,
>>
>> > > I think the in flight eh insertion done on the node doing the
>> encapsulation node A  is safer from a security perspective then an
>> intermediate node adding a eh header without encapsulation.  I think even
>> though you add an encapsulation but if the node doing the encapsulation is
>> not the one adding the eh header it’s no different in my opinion then the
>> node A not doing an encapsulation at all which was proposed initially by
>> Spring.
>> > >
>> > > So we have to enforce that the EH insertion is only done by the node
>> performing the encapsulation.
>> >
>> > With regards to your comment that node B doing insertion on a packet
>> with SA=A and DA=C, is equivalent to doing insertion on the original packet
>> without encapsulation, I think the risks of that is defined in Mark's
>> draft/8200.
>> >
>> > Let me dig down on the security issue a bit.
>> > Still given the simple example I gave earlier.
>> > Can you ellaborate on what security issue you see, and why doing
>> insertion at B is less secure than at A?
>> >
>> >      I was thinking the obvious man in middle attack tampering with v6
>> header by intermediate node and possible impact to AH if used.
>>
>> If AH is used, wouldn't A add the signature, and C when validating would
>> know that B added the header and could do verification accordingly?
>> For a controlled domain where all of A,B and C are acting in cohort, then
>> that wouldn't be too far fetched to assume.
>> At least a lot more probable than that AH would be used at all. ;-)
>
>
>     With AH the hash signature has to match between source and destination
> so in this case with eh insertion it would not
>
>>
>>
>> Any other security issues you see?
>
>
        I think in a controlled domain like an SP core I don’t see any
other impact.  Also you would not have  AH in the outer headers and only in
the payload so no impact really even with AH used by customers.

Is it possible if we don’t see any impact to make an exception to 8200 for
controlled domains and give example of an SP core.

>
>>
>> Cheers,
>> Ole
>
> --
>
> Gyan S. Mishra
>
> IT Network Engineering & Technology
>
> Verizon Communications Inc. (VZ)
>
> 13101 Columbia Pike FDC1 3rd Floor
>
> Silver Spring, MD 20904
>
> United States
>
> Phone: [phone]
>
> Email: [e-mail]
>
> www.linkedin.com/in/networking-technologies-consultant
>
> --

Gyan S. Mishra

IT Network Engineering & Technology

Verizon Communications Inc. (VZ)

13101 Columbia Pike FDC1 3rd Floor

Silver Spring, MD 20904

United States

Phone: [phone]

Email: [e-mail]

www.linkedin.com/in/networking-technologies-consultant