[spring] Re: [nasr] Seeking feedback on the SRv6 Path Verification draft [draft-yang-spring-srv6-verification-00]

[Meiling Chen <[e-mail]>]

Hi changwang,
Thank you for sharing the draft on the topic of path verification to NASR.
I have reviewed your draft, and the SRv6 Path Verification TLV is extended to address the risk of bypass.
That is to say, 
Risk: attackers can bypass some SRv6 endpoints if they can get correct HMAC. 
Reason for risk: HMAC is calculated per SRH [RFC8754], rather than the path the packet actually forwarded.
The solution is: at each endpoint, calculate the HMAC corresponding to its SID, and then add the result to the value in the HMAC TLV.
Record and verify the actual forwarding nodes, which is highly consistent with NASR, I think this is a specific use case for NASR.
But I have a question, how can attackers obtain the correct HMAC? Is HMAC calculated at the beginning node and verified at the last node?

Best,
Meiling


From: linchangwang
Date: 2025-04-01 13:41
To: [e-mail]; [e-mail]
Subject: [nasr] Seeking feedback on the SRv6 Path Verification draft [draft-yang-spring-srv6-verification-00]
Dear SPRINGWG and NASRWG,
This document proposes a path verification mechanism for SRv6, which
adopts a hop-by-hop cryptographic computation on the destination
segment identifier at each node, combined with an end-to-end
verification at the last hop.
Link:  https://datatracker.ietf.org/doc/draft-yang-spring-srv6-verification/
Slides: https://datatracker.ietf.org/meeting/122/materials/slides-122-spring-srv6-path-verification-01.pdf
 
Any feedback or comments are more than welcome.
 
Thanks,
Changwang
 
 
-------------------------------------------------------------------------------------------------------------------------------------
本邮件及其附件含有新华三集团的保密信息，仅限于发送给上面地址中列出
的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制、
或散发）本邮件中的信息。如果您错收了本邮件，请您立即电话或邮件通知发件人并删除本
邮件！
This e-mail and its attachments contain confidential information from New H3C, which is 
intended only for the person or entity whose address is listed above. Any use of the 
information contained herein in any way (including, but not limited to, total or partial 
disclosure, reproduction, or dissemination) by persons other than the intended 
recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender 
by phone or email immediately and delete it!