RE: Questions regarding the security mechanisms//RE: CRH and RH0

[Ron Bonica <[e-mail]>]

Fernando,

Good point. In order to use CRH as an attack vector, the attacker would need to know something about CRH to IPv6 address mappings.

I am assuming that the attacker has this information, either from an inside source (e.g., a disgruntled employee) or from effective guesswork.

                                                                                                                                     Ron



Juniper Business Use Only

-----Original Message-----
From: Fernando Gont <[e-mail]> 
Sent: Friday, May 15, 2020 4:16 PM
To: Ron Bonica <[e-mail]>; qinfengwei <[e-mail]>; 'Xiejingrong (Jingrong)' <[e-mail]>; 'Bob Hinden' <[e-mail]>; 'Darren Dukes (ddukes)' <[e-mail]>
Cc: '6man' <[e-mail]>
Subject: Re: Questions regarding the security mechanisms//RE: CRH and RH0

[External Email. Be cautious of content]


Ron,

On 15/5/20 17:08, Ron Bonica wrote:
> Fengwei, Jingrong,
>
> Your raise excellent questions, and I will try to address them.
>
> In 2007,  security researchers demonstrated that Routing headers can be used attack vectors. See the following slide deck:
>
> - 
> https://urldefense.com/v3/__http://www.secdev.org/conf/IPv6_RH_securit
> y-csw07.pdf__;!!NEt6yMaO-gk!V5RFYkrbeopG4qEvGTKEn3T-EjmwQ85kbakl0Wbppt
> beU0S5zl5X7vOoMeAD5NxQ$
>
> Therefore, we conclude that if a network contains nodes that process the CRH, it MUST deploy ACLs at its edge. These ACLs:
>       - MUST be sufficiently restrictive to filter harmful packets
>       - SHOULD NOT be so restrictive that they filter harmless packets.

I have not read your CRH draft (hence my comments might be non-sense), but it would seem to me that if the labels/SIDs you employ in CRH need mappings in the routers, and/or this functionality is turned off by default (i.e., support for CRH needs to be explitly enabled on the devices expected to use CRH), this is already a major difference and win over RHT0.

The main issue behind RHT0 and, for instance, IPv4 SR is that such functionality was enabled by default, and that all Internet nodes were in the position to process these packets.

If this is not the case, me, as an attacker, would have a much harder time exploiting CRH because I wouldn't even be able to get packets containing a CRH past my CE Router.

Thanks,
--
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492