RE: On SEND deployment (Re: Conclusion: 6MAN Adoption call on draft-rafiee-6man-ssas-07)

["Hosnieh Rafiee" <[e-mail]>]

Fernando,


> On 01/15/2014 05:03 AM, Ole Troan wrote:
> > We do not believe the working group understands why SEND is not
> > deployed.
> 
> My two cents:
> 
> * Use of trust anchors makes deployment painful for the general case.

This is why I proposed a local centralized RPKI in the second draft.

> * Most popular OSes do not have a real SEND implementation (not long ago
> the only way to play on BSDs was a Java implementation?). When it comes to
> open source ones, the fact that SEND is IPR'ed doesn't help the situation.

The reason is because of CGA


> * While other parts of the "system" are largely unsecured, SeND probably
> does not much. (e.g, if a local attacker can spoof a DNS response,
securing the
> layer-2/3 mapping will not buy much in most cases -- i.e., just spoof the
DNS
> response, and you're done).

I considered DNS spoofing to address that problem by proposing CGA-TSIG (it
use both SSAS/CGA as its solution) and it is implemented.

> * SEND wasn't there for v4. And there's a tendency to try to employ
> IPv6 as IPv4, focusing on the benefit of the larger address space (i.e.,
for
> some, "I lived with this in v4 for 20+ years, so..."). Not that I
necessarily
> endorse this view, but just meant to spell it out.

Current available mechanism also have problem and cannot mitigate IP
spoofing. This is the main reason I wrote that local security draft to
address these problems.

Hosnieh

----------