Re: [v6ops] [EXTERNAL] Re: Improving ND security

["Pascal Thubert (pthubert)" <[e-mail]>]

Hello Fred

A major attack vector is an external attacker sending packets to the 2^64 or so possible addresses in the subnet. The attack causes a denial of service at the router that MUST store one packet for one second and multicast a NS lookup, which multiplies the effect. The attack is easy to perform from the outside and send offers no protection. The only clear protection is to know in advance all the addresses present in the network and drop the rest. GRAND offers a way to preset the ND cache which is better than nothing but it offers no guarantee that the router has the full set of addresses I. Cache. In fact the concept of a cache is dated from the days memory was scarce and expensive. This concept is not needed And rather harmful in modern networks.


Regards,

Pascal

Le 31 juil. 2020 à 19:49, Templin (US), Fred L <[e-mail]> a écrit :


Hi Ted,

By “NM” I think you mean “Mobile Node?” That’s not really one of the use cases we’re talking about here. Or am I missing something?
[>]
Or, just call it a (mobile) “Stub-Network” – I think we are talking about the same
thing here.

In any case, you’re presuming some kind of trust establishment for non-router nodes, right? SEND only talks about trust establishment for routers. And, let’s be frank, doesn’t actually give us enough operational guidance that we would expect what _is_ said to be generally practicable.
[>]
OK, the specs I have been working dip their toes into the SEND pool but maybe they
should be updated to dive in completely? With an adoption call in progress, I don’t
know if it would be a good idea to make changes right now but be assured that it
will be added to the TODO list – would that be acceptable for now?

Thanks - Fred