[secdir] Security review of draft-ietf-6man-enhanced-dad-12

["Hilarie Orman" <[e-mail]>]

Security review of Enhanced Duplicate Address Detection 
draft-ietf-6man-enhanced-dad-12

Do not be alarmed ...
I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Enhanced DAD (duplicate address detection) is intended to help network
administrators with some debugging and measurement functions by
allowing IPv6 routers to detect that the network has been configured
for loopback testing.  Without this new feature, routers would treat
the recurring messages (the looped-back messages) as evidence of an
address duplication.  Currently, such an error should result in
disabling the interface until manual commands are entered.

The goal is to define a simple and reliable way for routers to detect
that loopback is in effect.  During the loopback testing, the
detection of duplicate addresses will not result in disabling the
interface.

The proposed detection method, as mentioned in the Security
Considerations, results in a new kind of attack, one in which
duplicate addresses are allowed because an attacker can easily imitate
or disable the loopback messages.  The authors believe that SEND and
SAVI protect against these attacks.  If these are not already in
place, an administrator must ask if the benefits of loopback are worth
the increased risk of operating, at least temporarily, without DAD.  If
not, then is it worth the trouble of adding additional protections?

The document intends to describe an algorithm and a state machine, but
it does not have the terse language and diagrams that one would expect
to accompany the prose descriptions.  It does not explicitly describe
what constitutes loopback detection.

There is a grammo in the following crucial sentence:
   If there is a collision because two nodes using the same Target
   Address in their NS(DAD) and generated the same random nonce, then
   the algorithm will incorrectly detect a looped back NS(DAD) when a
   genuine address collision has occurred. 

I think that the sentence can be repaired by changing "using" to
"used".  With that, we implicitly get the definition of loopback
detection: seeing two NS(DAD) messages with the same Target Address
and the same Nonce.  There is also a time window for the detection.

The document refers to the normal (non-loopback) case of duplicate
address detection as leading to the "DAD failed state".  This term
occurs almost nowhere else in the world.  It may be the case that an
interface in a failed state is not usually further qualified by the
cause; maybe this draft should avoid the term.  "Disabled because of
DAD" perhaps?

In section 5, I am confused by this statement:
   Any other network that follows the same trust model MAY use the
   automated actions proposed in this section.
The problem is that as nearly as I can tell, there is only one such
action in the section, the one in the immediately preceding sentence.

It seems to me that the time interval for detection might be usefully
replaced by a message count.  This is because the probability of
a nonce collision is the defining security metric, and that will
depend on the size of the nonce space and the number of messages
in the possible collision window.  The minimum nonce size is 48 bits,
a collision would be expected once in 16 million messages.  I suppose
that might happen on a very busy network with a small address space.

Hilarie