RE: FW: New Version Notification for draft-rafiee-6man-cga-attack-00.txt

[Christian Huitema <[e-mail]>]

> Sec value 1 => 2^(59+16)  for brute force searching => for birthday paradox
> => 2^(30)     This is actually the total security you obtain with sec value
> 1 and we know that the other sec values are not ideal to use
> Sec value 2=> 2^(59+32) for brute force searching => for birthday paradox =>
> 2^(45.5)    So you dramatically decreased the performance but you only could
> gain 15 more bits. 

The birthday paradox really does not apply in the SEND case. It would allow an attacker to generates two keys that map to the same IPv6 address, but it would not allow the attacker to target a specific address, you will need the brute force attack for that.

There is a related attack, against a group. Suppose a subnet of, say, 1024 nodes using SEND. An attacker that generates random value has 1024 chances each time to find a match not for one specific node, but for some random member of the subnet. It will need about 2^49 trials with SEND.

Of course, your SSAS proposal is also susceptible to that attack. In your design, the 64 bits are directly derived from the key, without mixing any subnet prefix. Suppose an attacker lists 1 million SSAS address from the DNS. In 2^44 trials, it will be able to find a match for at least one of them. 

The value of the SEC field does not change the number of required trials, but it makes each trial 2*(16*SEC) times more expensive.

>> The CGA mechanism protects an IPv6 address. All the identifier bits are part of
>> the IPv6 address. If an attacker uses a different SEC value, it is not attacking
>> the protected IPv6 address, but a different one.
> 
> I guess I am repeating myself here as I explained it before that how this
> attack can happens

I think you are repeating yourself. If an address differs by a few bits, it is a different address. The CGA mechanism answers the question, "is the sender the legitimate owner of the specific address." To spoof the address, you have to present a candidate that matches the target completely, including the SEC bits.


-- Christian Huitema