Re: [v6ops] Improving ND security

["Templin (US), Fred L" <[e-mail]>]

This is all good data; thank you. I don't buy the argument that SEND is too complex;
instead, I think it was simply a solution that was ahead of its time, but perhaps its
time has now come.

Fred

> -----Original Message-----
> From: ipv6 [mailto:[e-mail]] On Behalf Of Bjoern A. Zeeb
> Sent: Friday, July 31, 2020 12:03 PM
> To: v6ops list <[e-mail]>
> Cc: 6man <[e-mail]>
> Subject: Re: [v6ops] Improving ND security
> 
> On 31 Jul 2020, at 16:58, Fernando Gont wrote:
> 
> >> Is there agreement that this is a serious problem in any case?
> >
> > It is a problem... which seems to be more cost-effective solved with
> > smaller prefixes for P2P links and/or better management of the
> > neighbor cache (e.g. be more aggressive flushing/policing NC entries
> > in the incomplete state).
> 
> I agree that there are quite a few intelligent things which can be done
> on neighbour tables under attack to a certain level. People had this
> discussions [felt] like a decade ago as well and they should be in the
> archives.
> 
> 
> > SEND seems to me like a nice idea, but overly complex for the problem
> > it's trying to address.
> 
> It is these unbacked statements which people will use to reason against
> it.
> “complex” is not a cause unless it is backed by proper arguments.
> “trust distribution” is a thing, which doesn’t really work in a
> coffee shop around the corner.
> 
> I do agree that SeND does not solve all the problems either but having
> had it running since Ana Kukec (some might remember her from IETF) did
> this in 2009/2010 for FreeBSD [1] we’ve been shipping a mixed
> kernel/user space solution based on the DoCoMo NTT works which alos run
> on Linux and others.  People later produced WinSeND for Windows [2] and
> their paper read a lot like Ana’s.
> 
> I have no idea how the support for major OSes and router vendors is a
> decade later, but I’d be curious if someone would do a proper survey
> and post the results.  I think that would be super helpful (not as an
> RFC, but as a “state snapshot”);  could be a blog post or a cloud
> based spreadsheet somewhere.
> 
> /bz
> 
> 
> [1] https://wiki.freebsd.org/SOC2009AnaKukec
> [2]
> https://hpi.de/meinel/security-tech/next-generation-security-engineering/ipv6-security/winsend.html
>   (I hope the link is good, I cannot currently reach their site)
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------