Subject: RE: Proxy ND?

From: "Mohan Parthasarathy" <[email-masked]>
Date: Sun, 9 Mar 2003 21:17:18 -0800

> 
> On Sun, 9 Mar 2003, Jari Arkko wrote:
> > Interesting idea. In a way, this happens when the router and the
> > first node are upgraded to SEND: everyone else sends their ND
> > packets to the router, and all communications of the one SEND
> > node come through the router. The SEND node believes it is the
> > only node on the link. The other nodes are not on the link,
> > and ND is not used for communicating with them. Just like
> > any other node in the Internet.
> 
> Yep.
>  
I am a bit confused by this. If "L" bit is set in the RA, then all
nodes will think all other nodes covered by that prefix is on-link.
In that case all nodes on that link covered by that prefix
will send the advertisements to solicited node multicast address of
the target node directly i.e how do you make the nodes send the ND packets
to the router ? It would work if one never sets the L bit in that case.
But as the SEND hosts increase, you may want them to communicate directly
rather than through the router.

-mohan

> > Obviously, the non-SEND nodes will not authorize the router
> > or the router will not authorize them in any way. 
> 
> Yes, but if that'd help, the SEND router could perform certain proxy
> functions on behalf of the SEND node for non-SEND nodes; naturally,
> certain functions are already necessary, but some others 
> (e.g. the router
> might not believe some types of messages used for ND spoofing or other
> attacks) could also be added if that'd be of any help.  Might get too
> complicated, though..
> 
> > These are
> > existing nodes. So for that we don't need secure proxy ND.
> 
> Agree.
>  
> > But I guess your question is if we can simply provide SEND
> > for the RD part, and build secure ND from that? 
> 
> Yes.
> 
> > For instance, since the host trusts the router's keys, it 
> would believe
> > an NA sent by the router for a peer. The tricky part is, however,
> > getting the router to believe the peer. And it needs to, otherwise
> > sending an NA signed by the router would be pointless. With 
> delegation
> > chain discovery, all hosts can trust the router. But how to 
> get mutual
> > trust? This seems harder, basically something that would 
> require host
> > certs or CGA. And if you have those, is there a need for 
> the router to
> > act as a mediator?
> 
> In particular, all the SEND nodes might not have shared roots 
> -- it might
> be difficult to have everyone trust everyone else.  The 
> approach here is
> secure proxy-ND.  However, this could be made a bit more streamlined:
> there has to be a trust relationship with the router and host A.  The
> router could (maybe, can't estimate the complexity and the overhead),
> certify to node B that node A is a "good guy", which might help in
> building an association with node A and B.
> 
> It seems (quick thinking) to me that the approach for host-host
> communication could be one of:
> 
>  1) CGA
>  2) secure proxy-ND through router
>  3) router certifying host A to host B and vice versa: assistance in
> delegation chain discovery between the hosts if they don't have shared
> roots.
>  4) fallback to insecure ND or the like if two hosts have no 
> shared roots
> (ie. operational imperative to "get enough roots and certificates!")
> 
> However, the SEND protocol is quite unclear to me yet on how 
> exactly the
> certifying process even between a router/host would work 
> without CGA.  In
> particular, it seems some certificatetied to certain global and even
> link-local addresses which the other party can verify is needed.  This
> brings up the question how that kind of certifying process 
> could be done
> (particularly the link-local part, which seems like something only the
> admin of the link could be able to give -- which would lead 
> to either a
> trivial or a very difficult solution).
> 
> -- 
> Pekka Savola                 "You each name yourselves king, yet the
> Netcore Oy                    kingdom bleeds."
> Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
> 
> --------------------------------------------------------------------
> To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
> body to <[email-masked]>.
> Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
> --------------------------------------------------------------------
> 

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Mon, 10 Mar 2003 08:37:35 +0200 (EET)

> rather than through the router.

The neighbor solicitations are sent to the solicited-node multicast 
address.  However, the on-link target node will not respond to them: it 
will not even see them (because they're protected by AH and the target 
node can't verify AH).

This could be worked around by e.g.:

Modify the ND prototocol so that in the case of SEND:
 1) solicits are sent to all-nodes multicast address, or
 2) the SEND router also joins all solicited-node multicast addresses for 
non-SEND nodes so it can see the solicitations