Re: Questions regarding the security mechanisms//RE: CRH and RH0

[Fernando Gont <[e-mail]>]

Ron,

On 15/5/20 17:08, Ron Bonica wrote:
> Fengwei, Jingrong,
> 
> Your raise excellent questions, and I will try to address them.
> 
> In 2007,  security researchers demonstrated that Routing headers can be used attack vectors. See the following slide deck:
> 
> - http://www.secdev.org/conf/IPv6_RH_security-csw07.pdf
> 
> Therefore, we conclude that if a network contains nodes that process the CRH, it MUST deploy ACLs at its edge. These ACLs:
> 	- MUST be sufficiently restrictive to filter harmful packets
> 	- SHOULD NOT be so restrictive that they filter harmless packets.

I have not read your CRH draft (hence my comments might be non-sense), 
but it would seem to me that if the labels/SIDs you employ in CRH need 
mappings in the routers, and/or this functionality is turned off by 
default (i.e., support for CRH needs to be explitly enabled on the 
devices expected to use CRH), this is already a major difference and win 
over RHT0.

The main issue behind RHT0 and, for instance, IPv4 SR is that such 
functionality was enabled by default, and that all Internet nodes were 
in the position to process these packets.

If this is not the case, me, as an attacker, would have a much harder 
time exploiting CRH because I wouldn't even be able to get packets 
containing a CRH past my CE Router.

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492