Re: [secdir] Security review of draft-ietf-6man-enhanced-dad-12

["Hemant Singh (shemant)" <[e-mail]>]

Hilarie,

Thanks for the review.  Please see in line below.

>-----Original Message-----
>From: Hilarie Orman [mailto:[e-mail]] 
>Sent: Monday, February 02, 2015 6:48 PM
>To: [e-mail]; [e-mail]; [e-mail]
>Subject: Security review of draft-ietf-6man-enhanced-dad-12

>Security review of Enhanced Duplicate Address Detection
>draft-ietf-6man-enhanced-dad-12

>Do not be alarmed ...
>I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written >primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

>Enhanced DAD (duplicate address detection) is intended to help network administrators with some debugging and measurement functions by allowing IPv6 routers to detect >that the network has been configured for loopback testing.  Without this new feature, routers would treat the recurring messages (the looped-back messages) as evidence of an >address duplication.  Currently, such an error should result in disabling the interface until manual commands are entered.

>The goal is to define a simple and reliable way for routers to detect that loopback is in effect.  During the loopback testing, the detection of duplicate addresses will not result in >disabling the interface.

>The proposed detection method, as mentioned in the Security Considerations, results in a new kind of attack, one in which duplicate addresses are allowed because an attacker >can easily imitate or disable the loopback messages.  The authors believe that SEND and SAVI protect against these attacks.  If these are not already in place, an administrator >must ask if the benefits of loopback are worth the increased risk of operating, at least temporarily, without DAD.  If not, then is it worth the trouble of adding additional >protections?

Then the sending node, before initiating the deliberate Loopback circuit testing, can disable DAD on the interface.  Any other protection is likely a whole new RFC if SEND is not used. 

>The document intends to describe an algorithm and a state machine, but it does not have the terse language and diagrams that one would expect to accompany the prose >descriptions.  It does not explicitly describe what constitutes loopback detection.

>There is a grammo in the following crucial sentence:
   >If there is a collision because two nodes using the same Target
   >Address in their NS(DAD) and generated the same random nonce, then
   >the algorithm will incorrectly detect a looped back NS(DAD) when a
   >genuine address collision has occurred. 

>I think that the sentence can be repaired by changing "using" to "used".  With that, we implicitly get the definition of loopback
>detection: seeing two NS(DAD) messages with the same Target Address and the same Nonce.  There is also a time window for the detection.

Will make the change.

>The document refers to the normal (non-loopback) case of duplicate address detection as leading to the "DAD failed state".  
>This term occurs almost nowhere else in the world.  

That is why "DAD-failed state" is defined in the Terminology section. 

>It may be the case that an interface in a failed state is not usually further qualified by the cause; maybe this draft should avoid the term.  "Disabled because of DAD" perhaps?

It's not important what specific term is used and far as a term is defined. 

>In section 5, I am confused by this statement:
   >Any other network that follows the same trust model MAY use the
   >automated actions proposed in this section.
>The problem is that as nearly as I can tell, there is only one such action in the section, the one in the immediately preceding sentence.

Ok, will replace all "actions" with "action".

>it seems to me that the time interval for detection might be usefully replaced by a message count.  This is because the probability of a nonce collision is the defining security >metric, and that will depend on the size of the nonce space and the number of messages in the possible collision window.  The minimum nonce size is 48 bits, a collision would >be expected once in 16 million messages.  I suppose that might happen on a very busy network with a small address space.

We have used existing time intervals from RFC 4862 and RFC 4861.  The time interval is defined in RFC 4862 which says if a DAD probe is issued the sender waits for 2 seconds during which if no NA or the same DAD probe is received at the sender, the sender puts the Target Address to assigned state.  The Enhanced DAD algorithm uses time intervals defined in RFC 4861 which is the RetransTimer waiting how long and stopping the probe.   We acknowledge the nonce collision and have addressed the issue in the 2nd paragraph of section 4.  

Regards,

Hemant