Re: Scripting attacks [was Next step for draft-ietf-6man-rfc6874bis]

[Kerry Lynn <[e-mail]>]

On Thu, Jun 30, 2022 at 12:45 AM Carsten Bormann <[e-mail]> wrote:

> On 30. Jun 2022, at 06:40, Brian E Carpenter <[e-mail]>
> wrote:
> >
> > For the present draft, one thing my small experiment shows is that we
> won't make things worse by adding zone identifiers to URLs. They too have
> to be guessed by the attacker, and in modern Linux they are things like
> "enxb813ebc170a4" out of the box. That makes the attacker's job
> significantly harder.
>
> Do you know how enxb813ebc170a4 is generated?  (I.e., is the 48-bit thing
> in there guessable?)
>
> I think I agree with the conclusion (at least, that it is quite
> hard/costly/lengthy to mount an attack based on this), but I think that it
> would be good to get a clean argument for that in the security
> considerations.
>
> Is it sufficient to say there are easier ways to gather LL host addresses?

Maybe I'm missing something, but for LL address scanning mustn't the
attacker
already be on the link? Isn't it simpler to deploy a passive scanner and
just glean
active LL addresses?

Note there are 6lo data links (e.g. RFC 8163) where SLAAC address
construction
is done with many fewer than 48 bits. My argument there was to use 64-bit
opaque
IDs for globally-routable addresses, but short IDs for LL addresses to make
better
use of header compression. I didn't state the latter recommendation was also
because I felt sniffing on the link was trivial.

See also RFC 8605, where I encouraged Dave Thaler to distinguish between on-
and off-link attacks.

Kerry

Grüße, Carsten
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>