Re: AERO/OMNI dropping support for SEND/CGA

Hello Eduard 

I believe your question about a replacement for secure ND deserves its own thread to ensure a better visibility. 

Note: RFC 8928 was designed for a network where all nodes have a virtual P2P link with the router and the prefix shows as not-onlink; this way nodes only need to prove the ownership to the router and that makes things a lot simpler.

Keep safe,

Pascal

> Le 1 déc. 2020 à 10:07, Vasilenko Eduard <vasilenko.eduard@huawei.com> a écrit :
> 
> Hi Fred,
> SeND needs a refresh. CGA looks ridicules now in principle. You should not use it.
> 
> I am not sure: does it make sense to develop something else instead (based on ecliptic curves).
> As Fernando pointed many times: many things in ND could be resolved only by digital signature (he calls it "untrusted model").
> But as we see: market has rejected PKI. Digital signature is not useful without proper key management.
> IMHO: it is better to keep digital signature as a separate standard.
> Therefore, if you have cycles for separate OMNI addendum, then it is better to have it for completeness. If not - not much to lose now.
> But make sure that Open Key Cryptography and PKI (!) would be possible to add later.
> What if something would be innovated in PKI and it became popular?
> Reminder: PKI is needed not just for ND. Enterprises have the big pressure to protect all applications by TLS.
> Your vertical would probable lead on PKI adoption.
> 
> As an alternative: you could talk with IT and Security people in your vertical: if they believe in massive deployment of PKIs then you have to have Digital Signature for ND.
> It would still not guaranty that it would be used, because hosts would need support for it at ND level, but it is already the good situation to try.
> Hence again, better to keep it in separate specification.
> 
> Eduard
>> -----Original Message-----
>> From: ipv6 [mailto:ipv6-bounces@ietf.org] On Behalf Of Templin (US), Fred L
>> Sent: 1 декабря 2020 г. 1:12
>> To: ipv6@ietf.org
>> Subject: AERO/OMNI dropping support for SEND/CGA
>> 
>> Folks, this is a big decision point for the AERO/OMNI drafts but I am preparing to
>> drop support for SEND/CGA (RFC3971; RFC3972). This means that IPv6 ND
>> message authentication on OMNI interfaces will use a simple HMAC the same as
>> is done for Teredo (RFC4380; RFC6081). If anyone knows why that might cause
>> problems, it would be best to speak up now.
>> 
>> Fred
>> 
>> --------------------------------------------------------------------
>> IETF IPv6 working group mailing list
>> ipv6@ietf.org
>> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
>> --------------------------------------------------------------------
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------