Re: [v6ops] [EXTERNAL] Improving ND security

["Bjoern A. Zeeb" <[e-mail]>]

On 31 Jul 2020, at 16:58, Fernando Gont wrote:

>> Is there agreement that this is a serious problem in any case?
>
> It is a problem... which seems to be more cost-effective solved with 
> smaller prefixes for P2P links and/or better management of the 
> neighbor cache (e.g. be more aggressive flushing/policing NC entries 
> in the incomplete state).

I agree that there are quite a few intelligent things which can be done 
on neighbour tables under attack to a certain level. People had this 
discussions [felt] like a decade ago as well and they should be in the 
archives.


> SEND seems to me like a nice idea, but overly complex for the problem 
> it's trying to address.

It is these unbacked statements which people will use to reason against 
it.
“complex” is not a cause unless it is backed by proper arguments.
“trust distribution” is a thing, which doesn’t really work in a 
coffee shop around the corner.

I do agree that SeND does not solve all the problems either but having 
had it running since Ana Kukec (some might remember her from IETF) did 
this in 2009/2010 for FreeBSD [1] we’ve been shipping a mixed 
kernel/user space solution based on the DoCoMo NTT works which alos run 
on Linux and others.  People later produced WinSeND for Windows [2] and 
their paper read a lot like Ana’s.

I have no idea how the support for major OSes and router vendors is a 
decade later, but I’d be curious if someone would do a proper survey 
and post the results.  I think that would be super helpful (not as an 
RFC, but as a “state snapshot”);  could be a blog post or a cloud 
based spreadsheet somewhere.

/bz


[1] https://wiki.freebsd.org/SOC2009AnaKukec
[2] 
https://hpi.de/meinel/security-tech/next-generation-security-engineering/ipv6-security/winsend.html 
  (I hope the link is good, I cannot currently reach their site)