CGA Security improvement

[Hosnieh Rafiee <[e-mail]>]

Hi,


I would like to update draft-rafiee-rfc3972-bis-00 draft with the following content. What do you think about it? Any comments or questions? 



1.  Introduction 

   In the Cryptographically Generated Addresses (CGA) specification 
   [RFC3972], the 64 rightmost bits of an IPv6 address is securely 
   generated with a public key. This solution is able to provides the 
   proof of IP address ownership and then prevent source IP spoofing by 
   finding a binding between the public key and the node's IP address. 
   Unfortunately, during the verification step as explained in 
   [cga-attack], the verifier nodes ignore the 3 bits sec value in the 
   interface ID (IID) and there is no check between the source and 
   target IP address. This problem lead to the case where an attacker 
   can calculate a new CGA address which is identical to the address of 
   the victim node except its sec value field is zero. This document 
   tries to explain how to address this problem. 

   This document also tries to explain how CGA specification needs to be 
   changed when it is expected to support variable prefix. 


2.  Sec Value Solution 

   Sec value in CGA algorithm is the value between 0 to 7. This value 
   shows the strengthen of the algorithm against brute-force attacks. As 
   higher this value is, the more expensive and complicated the 
   algorithm is for the attacker. 

   As explained in [cga-attack], since there is no check between the 
   source and target addresses and the node ignores 3 bits sec values 
   during verification process, an attacker can try to perform 
   brute-force attacks without being detected. In other words, it does 
   not matter what sec value the legitimate node uses, the attacker can 
   always generate a new CGA address identical to the address of the 
   victim except of the sec value field, and use the address to 
   impersonate the legal node without being detected. To address this 
   problem, we propose the changes in the following section of RFC 3972: 
   

   

   - Section 5. new step MUST be placed before step 1 of verification. 

   1- If the sender's source address is not a multicast IP address, then 
   the verifier node MUST compare the sender's source address with its 
   own local and global IP addresses. If there is a match it starts the 
   other verification steps. Otherwise, it discards the message 
   silently. 

   If the sender's source address is a multicast IP address but the 
   target address is a unicast IP address, then the verifier node MUST 
   compare the target address with its own local and global IP 
   addresses. If there is a match then it MUST process the other 
   verification steps. If there is no match, it should discard the 

3.  CGA and Challenges in Variable Length Prefix 

   CGA algorithm, by default, uses a 64-bit prefix. The output of this 
   algorithm is a 64-bit IID. This value is the result of hashing 
   function on CGA parameters and taking only 64 bits of the hashing 
   result (digest). To conform CGA with a dynamic prefix length, the 
   number of bits which are taken from the hashing value should be the 
   same size.Having a dynamic prefix, as explained in [cga-attack], 
   might lead to the case where the attacker claim the address ownership 
   of other legitimate nodes with different prefix values. This is 
   specially true and feasible when prefixes are longer than 64 bits. In 
   other words, less bits are available for Interface ID. 


4.  CGA key size 

   Since there is no default key size mentioned in CGA specification, as 
   explained in [cga-attack], an attacker might use a very short key 
   size in order to easily play with it and generate a CGA value similar 
   to the victim one, in a timely manner. To prevent this attack, CGA 
   node MUST not use any key sizes that lower than 2048 bits. In future, 
   if there is any attack reported on this key size, CGA node SHOULD use 
   higher key sizes. 

Thanks,
Best,
Hosnieh


[cga-attack] https://tools.ietf.org/html/draft-rafiee-6man-cga-attack-01