Re: [Secdispatch] Comments on draft-xu-ipsecme-risav-00.txt

[Michael Richardson <[e-mail]>]

Tero Kivinen <[e-mail]> wrote:
    > It would be cheaper to just make sure that each AS will not allow
    > spoofing source addresses in the first place. And unless this gets
    > deployed in lots of places there is no protection against DoS, as the
    > attacker will simply use those AS which do not yet support this.

In an ideal command and control world, this would be easy.
What I think we see from the Operators (go to some NOG meetings, RIPE,
NANOG..) and from the savnet WGs, is that there are multiple complex
challenges that is preventing this from happening.   They are often
non-technical and we engineers might regard this issues as stupid.

    > The draft says that Inter-AS SAV requres different ASes to collaborate
    > and that makes it hard, and most likely that is the reason they are not
    > widely deployed.

    > This thing also requires coordination between ASes and what makes
    > authors to think this effort will be easier to deploy than those
    > earlier methods?

Because the inter-AS SAV requires dis-interested ASes to collaborate to help
the two ASs involved.  While this solution, while more expensive, involves
only the ASs that care.

    > Also I doubt the ICMP packet too big processing is going to work that
    > well, as there might not be enough data in the ICMP packet after they
    > remove the AH header so that the contained packet in ICMP looks like
    > whatever the original node sent out.

They will totally have to accomodate bigger than 1500 byte packets, and I
also have raised that issue.  I find the authors very inexperienced on this
topic and they have dismissed it out of hand.

    > On the other hand if they simply use ESP in tunnel mode then they can
    > use standard solutions for those issues, i.e., normal site to site VPN
    > products already solve those issues.

At the cost of significant impacts to often needed traffic analysis that is
used for load balancing/traffic engineer, and DoS impact.
(DDoS are still possible: but now you know who is doing it)
There are still jurisdictions where encryption is a problem, and I'd prefer
to know when they are being spoofed (or not), so we can blame the right parties.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [e-mail]  http://www.sandelman.ca/        |   ruby on rails    [


--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide