RE: Questions regarding the security mechanisms//RE: CRH and RH0

["Xiejingrong (Jingrong)" <[e-mail]>]

Hi John,
Please see my comment in-line below:

-----Original Message-----
From: John Scudder [mailto:[e-mail]] 
Sent: Sunday, May 17, 2020 3:18 AM
To: Xiejingrong (Jingrong) <[e-mail]>
Cc: Tom Herbert <[e-mail]>; Ron Bonica <rbonica=[e-mail]>; 6man <[e-mail]>; Bob Hinden <[e-mail]>
Subject: Re: Questions regarding the security mechanisms//RE: CRH and RH0

Hi Jingrong,

As far as I can tell, although 8754 S 5.1 is very nicely written, it boils down to “use border ACLs”. Specific to this:

[XJR] Yes RFC8754 boils down to "use border ACLs", but that kind of ACLs are truly available and thus make the deployment of SRH secure. The CRH border ACLs defined in current draft are not widely available, and thus make a huge surface for attacker.

On May 16, 2020, at 2:36 AM, Xiejingrong (Jingrong) <[e-mail]> wrote:
> 
> [XJR] Once an attack packet pass through the border router, there is no additional protection like the "complemented per-node protection" in RFC8754 section 5.1.

I think the “complemented per-node protection” in S 5.1 part 2 is not especially valuable, and may even be detrimental. The reasoning is as follows: if the border routers do correctly implement destination address filtering per part 1, attack traffic will already be stopped; there is no need for the source address filtering part 2 specifies. On the other hand, if the border routers do not correctly implement DA filtering, why on earth would we expect them to correctly implement SA filtering? If they don’t, then an attacker can craft their attack with forged SA to bypass SA filtering within the victim network. For this reason, I think the “complemented per-node protection” is of little value. It may be of negative value if it leads to a sense of complacency on the part of the victim.

[XJR] The "complemented per-node protection " is very useful for a layered security mode. Given the above weakness, the CRH may need the "complemented per-node protection" more than SRH. 

Thanks
Jingrong


Regards,

—John