RE: CGA Security improvement

["Hosnieh Rafiee" <[e-mail]>]

Roland,

Thanks for your review.
> Am 31.07.2015 um 09:33 schrieb Hosnieh Rafiee:
> > I would like to update draft-rafiee-rfc3972-bis-00 draft with the
following
> content. What do you think about it? Any comments or questions?
> 
> 1) I still don't understand your "attack scenario"
> 
>   - https://tools.ietf.org/html/draft-rafiee-6man-cga-attack-01 is
>     not clear enough. What is course of the attack precisely?

The latest version of CGA attack is 03. 
https://tools.ietf.org/html/draft-rafiee-6man-cga-attack-03
check section 6.1 and 6.2 



>   - Two addresses A0 and A1 that only differ in the
>     sec value (e.g., sec=0 and sec=1) are considered being
>     different, i.e., A0 != A1. So your attacker that uses
>     A0 instead of A1 has got a different address with a
>     different public/private key pair.
>

They are absolutely different but the way the document consider them are the
same. In other word, how the document verify the other node. Therefore the
attacker has a chance to spoof the IP of other node. Again please read the
latest version.

>   - CGA prevents _hijacking_ of IPv6 addresses only.

It cannot prevent this if the implementation do not consider the
modification that was suggested in CGA_improvement document
Or the latest version that I am going to upload and sent the information on
the list before uploading it

> 2) given the presumably small real world deployment of CGAs,
>    I think there are currently more important problems this
>    WG needs to solve first...

Not sure about that. Maybe not for SeND protocol. But in other working group
they think differently about this. They are going to use it as an
authentication way for DHCP... or in SAVI it is still considered.
Best ,
Hosnieh