Re: FW: New Version Notification for draft-rafiee-6man-cga-attack-00.txt

[Ray Hunter <[e-mail]>]

Hosnieh Rafiee wrote:
> Here you go! Sorry for typos or bad organization since I wrote it so fast. The next versions will be better.
>
> BTW, as I explained in my previous message, you can bombard me with too many emails but please do not expect immediate answer for the next 3 upcoming days since I will have limited internet access.
>
> -----------smile----------
> Hosnieh
>
>
>
> A new version of I-D, draft-rafiee-6man-cga-attack-00.txt
> has been successfully submitted by Hosnieh Rafiee and posted to the IETF repository.
>
> Filename:	 draft-rafiee-6man-cga-attack
> Revision:	 00
> Title:		 Possible Attack on Cryptographically Generated Addresses (CGA)
> Creation date:	 2013-11-25
> Group:		 Individual Submission
> Number of pages: 7
> URL:             http://www.ietf.org/internet-drafts/draft-rafiee-6man-cga-attack-00.txt
> Status:          http://datatracker.ietf.org/doc/draft-rafiee-6man-cga-attack
> Htmlized:        http://tools.ietf.org/html/draft-rafiee-6man-cga-attack-00
>
>
> Abstract:
>    This document describes the new vulnerabilities with the use of
>    Cryptographically Generated Addresses.
>
I have read this draft and RFC3972.

I agree the CGA information will match in the case mentioned, and thus
it is possible to make CGA verification succeed for two different hashes
for two different values of sec (one with lower sec value being easier
to generate than the other).

But didn't we know that already?

Does this have more to do with how/where CGA is applied or misapplied?

Since the 3 bits of the sec level are copied from the IID, won't any
mismatch in the sec value used to create the hash be picked up by a
simple comparison of the received IID with the machines local IID in the
case of DAD?

i.e. if the attacker sets sec=0 (to allow them to perform a simple fast
search to attack machines using sec =1 ) and the target machine has used
sec =1, the CGA check will pass to step 7, but the source IPv6 address
and the local interface address are different, so the machine knows not
to "waive his rights" to it's own address as you put it, even if the
address was still marked as tentative. If DAD had already completed, I
don't see that this would have any effect.

And the other way on, if the attacker sets sec=1 and the target machine
has sec = 0, the CGA will pass, but finding a collision with sec =1
should be a harder problem to solve, and again the addresses will not match.

So I have to say that I do not understand the novelty of the attack,
unless this is an implementation specific issue, rather than a standards
issue.



>
>
>
>                                                                                   
>
>
> Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.
>
> The IETF Secretariat
>
>

-- 
Regards,
RayH