Subject: SEND with link-layer security

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 20 Nov 2003 15:15:00 -0800

I have a question on section 11.1 of  draft-ietf-send-ndopt-00.

11.1 Threats to the Local Link Not Covered by SEND

   SEND does not compensate for an insecure link layer.  In particular,
   there is no cryptographic binding in SEND between the link layer
   frame address and the IPv6 address.  On an insecure link layer that
   allows nodes to spoof the link layer address of other nodes, an
   attacker could disrupt IP service by sending out a Neighbor
   Advertisement having the source address on the link layer frame of a
   victim, a valid CGA address and a valid signature corresponding to
   itself, and a Target Link-layer Address extension corresponding to
   the victim.  The attacker could then proceed to cause a traffic
   stream to bombard the victim in a DoS attack.  To protect against
   such attacks, link layer security MUST be used.  An example of such
   for 802 type networks is port-based access control defined in the
   802.1X standard [34].

I am not sure how link-layer security helps. 802.1x will not check the
target link-layer address option. It checks only the source address
of the mac header. And IP layer does not check the source mac address
and only checks the target link layer option. So, how does link layer
security help this case ?

thanks
mohan
--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: "James Kempf" <[email-masked]>
Date: Thu, 20 Nov 2003 15:34:22 -0800

Mohan,

I think this was one of the issues we resolved in the last round. Please
check the issues page
(http://users.piuha.net/jarkko/publications/send/issues/) and if that does
not answer your question, repost it. Thanx.

            jak

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Thu, 20 Nov 2003 17:38:14 -0800

> not answer your question, repost it. Thanx.
From what i can tell, it does not seem to answer the question. Unless you
recommend
the IP layer to cross check the source address of the mac header and the
target
link layer option AND you have 802.11i type security (that prevents mac
address
spoofing), this DoS attack cannot be prevented. But i remember some
discussion
in the past regarding why IP does not do the check. So, wihtout that, i
don't see
how this attack can be prevented.

If my understanding is correct, the IP address ownership seems to solve the
redirection attack problem i.e the attacker cannot redirect packets that
are destined  to some other address (that it does not own) to itself , but
it
still can cause flooding attacks by having the victim's mac address in the
target link layer option of the NA.

-mohan

-mohan

---

From: Jari Arkko <[email-masked]>
Date: Fri, 21 Nov 2003 09:13:24 +0200

Mohan,

Thanks for your question. Inline:

> target link-layer address option. It checks only the source address of
> the mac header. And IP layer does not check the source mac address and
> only checks the target link layer option. So, how does link layer
> From what i can tell, it does not seem to
> answer the question. Unless you recommend the IP layer to cross check
> the source address of the mac header and the target link layer option
> AND you have 802.11i type security (that prevents mac address
> discussion in the past regarding why IP does not do the check. So,
> wihtout that, i don't see how this attack can be prevented.
> 
> If my understanding is correct, the IP address ownership seems to
> solve the redirection attack problem i.e the attacker cannot redirect
> packets that are destined to some other address (that it does not own)
> to itself , but it still can cause flooding attacks by having the
> victim's mac address in the target link layer option of the NA.

In issue 24 we discussed this:
http://users.piuha.net/jarkko/publications/send/issues/issue24.txt
This brought us the text that follows the part that you quoted.

The first part of Section 11.1 seems to say (more on this later)
that the layer 2 - 3 binding is covered when both SEND and L2 security
are used; the second part of Section 11.1 seems to imply otherwise.

I think the bottom line is the following:

   o  L2 security such as 802.11i can indeed ensure that the right
      sender uses the given MAC address.

   o  The specific attack mentioned in the beginning of 11.1
      is that the attacker lies both about the L2 and the ND target
      address. *This* attack is in fact prevented by the use of
      L2SEC + SEND. So it only seemed that the text was inconsistent...

   o  However, there's another attack which is *not* prevented:
      the attacker lies just about the ND target address.
      Since neither L2 or SEND checks the L2 information against
      L3 information, there's currently nothing that prevents
      this attack.

   o  We have discussed the prevention of this attack in SEND,
      but it would require stacks to retain the L2 addresses
      of the packets until the packets are processed by ND.
      Folks felt that this of a too tough requirement.

So now I have a few questions:

1. Given the above, what change would you Mohan like to
    make to 11.1 to clarify it?

2. Is everyone still comfortable with the fact that no
    one is doing the L2-L3 cross check?

--Jari

---

From: "James Kempf" <[email-masked]>
Date: Fri, 21 Nov 2003 09:47:55 -0800

>     one is doing the L2-L3 cross check?

Might be worthwhile to mention it SHOULD be done in order to prevent the
attack.

            jak

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Fri, 21 Nov 2003 09:51:40 -0800

<snip>
> are used; the second part of Section 11.1 seems to imply otherwise.
Yeah. But the second part was not very clear.

>       L3 information, there's currently nothing that prevents
Agreed.

>     make to 11.1 to clarify it?
Yes, i am looking for a clarification. It would make it clear as to
what SEND protects.

>     one is doing the L2-L3 cross check?
I just re-read Pekka's summary on this issue. There were many reasons why it
is not done.
And Erik responded saying that in some cases it even provides flexibility
like
in bridging or even in some cases where there is no actual link-layer
address.
So, i am not sure how feasible this is. But it might be worth recommending.

-mohan