Re: Overview of IPv6 first-hop issues and solutions - was: RE: IPv6 first-hop risks and threats and mitigations

On Tue, Dec 22, 2020 at 3:25 AM Xipengxiao <xipengxiao@huawei.com> wrote:

> Hi Christopher,
>
> >>  there's a set of things other than just ra-guard in their document
> lists.
>
> Understood.  I used "RA-guard(+)" as an example.  There are also the SAVI
> related works.
>
> >> it'd be good to see perhaps a threat-analysis document and from that
> smoe requirements discussion. as I noted in a different mail I guess while
> whacking at fires around the camp fernando/jen have hit some highlights,
> but there could be useful (threat analysis/etc) done still and cleanup of
> the remaining problems.
>
> Good suggestion.  Will try to work out a skeleton during the holiday break
> and send to the ML.  Again, if anybody is interested in participating in
> this, please contact us.  So far we have Pascal, Eduard Metz, and myself.

   Gyan> I would be interested in first hop IPv6 security.  This is a
critical topic for all operators.

>
>
> Happy holidays and stay safe!
>
> XiPeng
>
> -----Original Message-----
> From: Christopher Morrow [mailto:christopher.morrow@gmail.com]
> Sent: Monday, December 21, 2020 7:29 PM
> To: Xipengxiao <xipengxiao@huawei.com>
> Cc: Michael Richardson <mcr+ietf@sandelman.ca>; Nabil Benamar <
> benamar73@gmail.com>; Pascal Thubert (pthubert) <pthubert=
> 40cisco.com@dmarc.ietf.org>; 6man Chairs <6man-chairs@ietf.org>;
> ipv6@ietf.org
> Subject: Re: Overview of IPv6 first-hop issues and solutions - was: RE:
> IPv6 first-hop risks and threats and mitigations
>
> On Fri, Dec 18, 2020 at 5:28 AM Xipengxiao <xipengxiao@huawei.com> wrote:
> >
> > Hi Christopher,
> >
> > Firstly I assume that by "work Fernando / Jen" you meant RA-guard(+) /
> Grand.  If you are talking about something else please let me know.  I want
> to make sure that we are talking about the same things.
> >
>
> there's a set of things other than just ra-guard in their document lists.
>
> > With that assumption, my answer to your question is:
> >
> > I think ND has some issues, e.g. (1) trust model - ND trust all messages
> (2) heavily utilizing multicast (3) not considering sleeping nodes (4)
> reactive not proactive.   This is because ND was designed many years ago
> when many things like smartphones, Wi-Fi didn't exist.  Fernando/Jen's
> works solved (1) & (4), Pascal's WiND (arguably) solved all these issues.
> But it changed ND fundamentally.  Should it be used only in wireless
> environment or both wireless & wired environment?  Recently Ole also
> published a P2P Ethernet draft to deal with (2).  Long story short, I don't
> think Fernando/Jen have solved all the issues.  There are many different
> solutions, each with its pros and cons.
> >
> > Furthermore, first-hop protocols are more than ND.  There are also
> SLAAC, DHCPv6 etc.  They also have some unsolved issues.  Variable SLAAC,
> universal-ra-option-04 are examples to deal with those issues.
> >
>
> sure.
>
> > So in summary, I (and several other people in the WG) think there are
> issues in various first-hop protocols.  Some are solved, some are not.  For
> those solved issues, the solutions have pros and cons.  All of these are
> dispersed in many RFCs/drafts.  We believe it's helpful to summarize all
> the first-hop issues, and compare the solutions, in a single document.
> This is just like Eric's draft-ietf-opsec-v6-21 summarize many IPv6
> security issues into a single document.  We believe this would provide an
> opportunity for the WG to discuss the issues and existing solutions, and to
> decide the next steps.   For this reason, I've changed the subject to
> reflect our intention more accurately.  We in fact have a table of content
> reflecting some early thoughts of this work.  If anybody is interested
> please drop me a line.  We will send the TOC to you, and we welcome your
> participation.
> >
>
> it'd be good to see perhaps a threat-analysis document and from that smoe
> requirements discussion. as I noted in a different mail I guess while
> whacking at fires around the camp fernando/jen have hit some highlights,
> but there could be useful (threat analysis/etc) done still and cleanup of
> the remaining problems.
>
> > Thanks and happy holidays to all!
> >
> > XiPeng
> >
> >
> >
> > -----Original Message-----
> > From: Christopher Morrow [mailto:christopher.morrow@gmail.com]
> > Sent: Thursday, December 17, 2020 6:29 PM
> > To: Xipengxiao <xipengxiao@huawei.com>
> > Cc: Michael Richardson <mcr+ietf@sandelman.ca>; Nabil Benamar
> > <benamar73@gmail.com>; Pascal Thubert (pthubert)
> > <pthubert=40cisco.com@dmarc.ietf.org>; 6man Chairs
> > <6man-chairs@ietf.org>; ipv6@ietf.org
> > Subject: Re: IPv6 first-hop risks and threats and mitigations
> >
> > I thought this was work Fernando Gont / Jen Linkova already undertook...
> or had already taking some large steps to cover at any rate.
> > Were their docs not helpful here?
> >
> > On Wed, Dec 16, 2020 at 3:37 PM Xipengxiao <xipengxiao@huawei.com>
> wrote:
> > >
> > > Hi Michael,
> > >
> > >
> > >
> > > >> So, the idea being to write down the issues, give the attacks
> names, and then clarify what defenses we have already and how well they
> work?
> > >
> > >
> > >
> > > Yes.  Are you interested in working on this together?  Happy holidays!
> > >
> > >
> > >
> > > XiPeng
> > >
> > >
> > >
> > > -----Original Message-----
> > > From: Michael Richardson [mailto:mcr+ietf@sandelman.ca]
> > > Sent: Monday, November 23, 2020 1:24 AM
> > > To: Xipengxiao <xipengxiao@huawei.com>; Nabil Benamar
> > > <benamar73@gmail.com>; Pascal Thubert (pthubert)
> > > <pthubert=40cisco.com@dmarc.ietf.org>; 6man Chairs
> > > <6man-chairs@ietf.org>; ipv6@ietf.org
> > > Subject: IPv6 first-hop risks and threats and mitigations
> > >
> > >
> > >
> > >
> > >
> > > Xipengxiao <xipengxiao@huawei.com> wrote:
> > >
> > >     > I also think that it’s a good piece of work, and shouldn’t be
> given up.
> > >
> > >
> > >
> > >     > I would also like to take this opportunity to propose that the
> > > WG start
> > >
> > >     > a “problem statement of IPv6 first-hop protocols” draft.  The
> > > rationale
> > >
> > >     > is: many IPv6 first-hop protocols like ND, SLAAC were designed
> > > long
> > >
> > >     > time ago; many things have changed over the years, e.g. the
> > > advent of
> > >
> > >     > wireless, mobility, IoT, overlays;  lately there are multiple
> > > drafts
> > >
> > >     > trying to fix various issues in a number of IPv6 first-hop
> > > protocols,
> > >
> > >     > including:
> > >
> > >
> > >
> > > So, the idea being to write down the issues, give the attacks names,
> and then clarify what defenses we have already and how well they work?
> > >
> > >
> > >
> > > --
> > >
> > > Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT
> consulting )
> > >
> > >            Sandelman Software Works Inc, Ottawa and Worldwide
> > >
> > > --------------------------------------------------------------------
> > > IETF IPv6 working group mailing list ipv6@ietf.org Administrative
> > > Requests: https://www.ietf.org/mailman/listinfo/ipv6
> > > --------------------------------------------------------------------
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>
-- 

<http://www.verizon.com/>

*Gyan Mishra*

*Network Solutions A**rchitect *

*M 301 502-134713101 Columbia Pike *Silver Spring, MD