Re: IPv6 header insertion in a controlled domain

[Gyan Mishra <[e-mail]>]

On Sun, Dec 8, 2019 at 11:03 AM <[e-mail]> wrote:

> Gyan,
>
> > I think the in flight eh insertion done on the node doing the
> encapsulation node A  is safer from a security perspective then an
> intermediate node adding a eh header without encapsulation.  I think even
> though you add an encapsulation but if the node doing the encapsulation is
> not the one adding the eh header it’s no different in my opinion then the
> node A not doing an encapsulation at all which was proposed initially by
> Spring.
> >
> > So we have to enforce that the EH insertion is only done by the node
> performing the encapsulation.
>
> With regards to your comment that node B doing insertion on a packet with
> SA=A and DA=C, is equivalent to doing insertion on the original packet
> without encapsulation, I think the risks of that is defined in Mark's
> draft/8200.
>
> Let me dig down on the security issue a bit.
> Still given the simple example I gave earlier.
> Can you ellaborate on what security issue you see, and why doing insertion
> at B is less secure than at A?


     I was thinking the obvious man in middle attack tampering with v6
header by intermediate node and possible impact to AH if used.

>
>
> Best regards,
> Ole

-- 

Gyan S. Mishra

IT Network Engineering & Technology

Verizon Communications Inc. (VZ)

13101 Columbia Pike FDC1 3rd Floor

Silver Spring, MD 20904

United States

Phone: [phone]

Email: [e-mail]

www.linkedin.com/in/networking-technologies-consultant