Subject: Forwarded message from PANA WG mailing list

From: Pekka Nikander <[email-masked]>
Date: Thu, 02 Jan 2003 10:19:27 +0200

Folks,

One issue that we have to think about is the
relationship between SEND and PANA.  Before
Christmas people at the PANA mailing list were
discussing whether PANA should work without IP
addresses or not.  One solution would be to use
link local addresses in IPv6, but that would be
prone to address depletion DoS attacks.

Now, if the ND part of SEND would work without
a trust anchor, it would be possible to configure
link local addresses very early in any configuration
process.  That would be good, IMHO.  However, even
if CGA was used, there would be problems, since 64
(or 62) bits of hash is perhaps too short.

Any ideas or thoughts?

--Pekka

Subject: Re: PANA and IP address configuration
From: "Alper E. YEGIN" <[email-masked]>
To: "Yoshihiro Ohba" <[email-masked]>
Cc: "Yoshihiro Ohba" <[email-masked]>, <[email-masked]>, <[email-masked]>, <[email-masked]>
Date: Fri, 6 Dec 2002 19:08:08 -0800

> > The solution to address depletion attack is not as simple as saying
> > "use link-local addresses". For one, the PaC needs to perform duplicate
> > address detection on these addresses as well, which opens up a window
> > of opportunity for the malicious hosts to attack: they can claim every
> > address that the legitimate PaC is attempting to configure and starve
the
> > PaC.
>
> OK, the definition for address depletion attack in this context includes
> duplicate address detection attack.  Then....
>
> Regarding the DAD attack for IPv6 ND, isn't it solved by SEND?

It depends on which comes first, SEND or PANA? If SEND requires
a trust relation between the host and the network, this might
imply that PANA should happen first.

>
> And regarding the DAD attack for ARP, I'm not still sure how PANA
> without IP address can help solve the situation.  For example, an
> authenticated PaC by using PANA without an IP address may be able to
> obtain an IP address via DHCP authentication, but I think the
> duplicate address detection attack is still possible when ARP check is
> performed in the DHCP.

But in this case, this attack cannot be launched by an unauthenticated
hosts, right? Because, until a host is authenticated, EP won't let
it send non-PANA packets, therefore not give it a chance to send
bogus ARP responses. (note that in the case of configuring an IP
address before PANA, ARP packets have to freely flow around even from
unauthenticated hosts).

alper