Subject: issue 33 - SEND and L2 security

From: <[email-masked]>
Date: Mon, 22 Dec 2003 12:56:43 +0200

My intention is to close this issue. I think we agree that there
are issues if there is no L2 security and that there are issues
if there is no L2 - L3 binding. In terms of our document, I think
we agreed about the following:

  o  Say that there is need for L2 security, as the current first
     paragraph in Section 11.1 does.

  o  Add text to state that a binding between L2 and L3 would be
     desirable but that this document does not cover it.

  o  Remove detailed discussion of IEEE 802 security specifications;
     this is not in our scope.

Note that this changes the parts that we already agreed in issue 24.
But I think the new text is better, as it still describes the issues
but does not go into the details of specific link layers.

I also downgraded the "MUST use link layer security" to a SHOULD. I
think it would make sense to use SEND even if you did not have a
secure link layer -- such as on an IETF wireless network -- and doing
so should not violate the standards.

Here's the new Section 11.1 text relating to this issue:

   SEND does not compensate for an insecure link layer.  For instance,
   there is no assurance that payload packets actually come from the
   same peer that the Neighbor Discovery protocol was run against.

   SEND does not provide confidentiality for Neighbor Discovery
   communications.

   There may be no cryptographic binding in SEND between the link layer
   frame address and the IPv6 address.  On an insecure link layer that
   allows nodes to spoof the link layer address of other nodes, an
   attacker could disrupt IP service by sending out a Neighbor
   Advertisement having the source address on the link layer frame of a
   victim, a valid CGA address and a valid signature corresponding to
   itself, and a Target Link-layer Address extension corresponding to
   the victim.  The attacker could then proceed to cause a traffic
   stream to bombard the victim in a DoS attack.  To protect against
   such attacks, link layer security SHOULD be used.

   Even on a secure link layer, SEND does not require that the addresses
   on the link layer and Neighbor Advertisements correspond to each
   other.  However, it is RECOMMENDED that such checks be performed
   where this is possible on the given link layer technology.

The modifications are also visible in
http://www.piuha.net/~jarkko/publications/send/issues/issue33diff.html

Comments appreciated.

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: "James Kempf" <[email-masked]>
Date: Mon, 22 Dec 2003 09:51:11 -0800

Sounds fine.

            jak

---

From: "Mohan Parthasarathy" <[email-masked]>
Date: Mon, 22 Dec 2003 10:55:04 -0800

>    such attacks, link layer security SHOULD be used.
The last sentence is confusing. The  bulk of the text above explains the
attack.
At last it says, the link layer security provides protection which is not
completely
correct. The following paragraph below explains what is needed to prevent
the attack. So, i would suggest removing the last sentence above. Instead
you
can say  something like "This attack cannot be prevented just by securing
the
link layer alone".  Then the following paragraph seems like a good fit..

>    where this is possible on the given link layer technology.

-mohan