Subject: RE: Last Call: 'Cryptographically Generated Addresses (CGA)' to Proposed Standard

From: "Tuomas Aura" <[email-masked]>
Date: Thu, 5 Feb 2004 17:42:56 -0800

Pekka wrote:
> Further, I wonder if it's possible to force an implementation to heavy
> computation resulting from the generation of a new address, e.g., by a
> DAD attack.  This doesn't seem to be the case, because the really
> expensive Hash2 is only computed once even if there were collisions.

Correct. DAD+CGA cannot be used for DoS.

> This clarifies the verification part -- my comment also included
> (maybe a misunderstanding) about the generation process.  For sec>1
> you have to generate the hash, to look for all zeros, thousands,
> millions (or even more) times.  That may be pretty bad.  I didn't
> understand right out the purpose for this.  Now it seems that the
> reason may be to optimize it for those that are checking CGA's.  Maybe
> this needs a bit spelling out.

The reason for the generation to be expensive is the following:
The maximum hash length that can fit into the 64-bit interface
identifier
is 64 bits. This may not be enough to protect against brute-force
attacks
in the future. But by making the address generation more expensive, we
can also make the brute-force attack more expensive. The attacker will
always have to do 2^59 times as much work as the address generator. 
The address generator can choose freely how much work he wants to do.
This is explained in Section 7.2.

>   <?rfc iprnotified="yes"?>

Thanks.

Tuomas

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

This communication is confidential and intended solely for the addressee(s). Any unauthorized review, use, disclosure or distribution is prohibited. If you believe this message has been sent to you in error, please notify the sender by replying to this transmission and delete the message without disclosing it. Thank you.

E-mail including attachments is susceptible to data corruption, interruption, unauthorized amendment, tampering and viruses, and we only send and receive e-mails on the basis that we are not liable for any such corruption, interception, amendment, tampering or viruses or any consequences thereof.