Subject: [lisp] Comments on draft-ietf-lisp-eid-anonymity-00

From: "Rene 'Renne' Bartsch, B.Sc. Informatics" <[email-masked]>
Date: Wed, 25 Oct 2017 09:41:06 +0200

Hi,

'draft-ietf-lisp-eid-anonymity-00' does not mention any authentication 
of the LISP-nodes/xTRs with the map-servers.
That way a Man-In-The-Middle-Attack can be run by sending bogus 
map-requests with the MITM-attacker's RLOCs.

I suggest to allow only CGA-addresses.

Benefits:

1. Privacy:         Dynamic eEIDs by re-keying
2. Reachability: Static      eEIDs by static key-pairs allow direct 
connections without third-party services relaying (e.g. Facebook ;-) )
3. Security:

    1. Signed map-requests
    2. eEID-based authentication/authorization with static keypairs
    facilitates administration
        (e.g. road-warrior authentication/authorization can be done with
    a firewall by eEID filtering
        without any upper-layer authentication/authorization like
    usernames/passwords involved)

Privacy/security considerations:

    1. Don't use dynamic and static eEIDs on the same RLOC!
    2. Always use payload encryption to avoid deanonymisation by
    Deep-Packet-Inspection

Regards,

Renne

---

From: Dino Farinacci <[email-masked]>
Date: Thu, 26 Oct 2017 20:57:59 -0700

> Hi,

Thanks for the comments Rene!

> 'draft-ietf-lisp-eid-anonymity-00' does not mention any authentication of the LISP-nodes/xTRs with the map-servers.
> That way a Man-In-The-Middle-Attack can be run by sending bogus map-requests with the MITM-attacker's RLOCs.

Well we do have the regular shared-key authentication documented in draft-ietf-lisp-rfc6831bis. But we can also put a reference in for draft-farinacci-lisp-ecdsa-auth if you are looking for stronger ways to authenticate.

There is a reference in this section:

> 2. Reachability: Static      eEIDs by static key-pairs allow direct connections without third-party services relaying (e.g. Facebook ;-) )

Yes, understand.

>   2. Always use payload encryption to avoid deanonymisation by

Right, this is all in draft-farinacci-lisp-ecdsa-auth. Have you looked at it?

Dino