Subject: RE: CGA issues

From: "Soliman Hesham" <[email-masked]>
Date: Mon, 10 May 2004 05:03:42 -0400

> Still, I don't see the value in having the subnet prefix in 
 > the hash, 
 > and there's still the issue of address rewriting.
 > 
 > Are there any attacks that can be fended off this way? If 
 > it's just a 
 > privacy thing I don't think that's enough justification, as it's 
 > already possible to generate a new hash based on an existing key by 
 > selecting a new "modifier" value. The only problem here is 
 > that this is 
 > more expensive when a "Sec" is in effect. But that's pretty much a 
 > feature rather than a downside.

=> I don't see the value of adding the prefix for SEND. 
However, if the intention is to define CGAs for general
purpose security wherever address ownership is an issue
then I do see a value of adding the prefix. This was discussed
in the context of using CGAs to secure MIPv6 signalling. 

Of course there is a danger in having two different ways
of generating a hash (one with the prefix and one without).
A node using CGAs for SEND might want to use the same address
as a MIPv6 CoA (most likely of course). There is no point 
in having one address for ND security and another 
for MIPv6 and another for multi6 ;) 
So we might need to somehow find the lowest common denominator
here in order to use CGAs in a generic manner. 

Hesham

 > 
 > BTW, I'm no statistician and I don't play one on tv, but 
 > isn't there a 
 > significant chance that you're going to run into statistical 
 > anomalies 
 > when searching for a SHA-1 hash with a certain number of 0 
 > bits in it? 
 > I mean, the chance of getting a SHA-1 with all 0 bits in the 
 > lowest 16 
 > bits would be 1 in 65536. But that doesn't automatically 
 > mean that if 
 > you try 65536 times you hit one. Has anyone done the math on this?
 > 
 > --------------------------------------------------------------------
 > To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
 > body to <[email-masked]>.
 > Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
 > --------------------------------------------------------------------
 > 

========================================================
This email may contain confidential and privileged material for the sole
use of the intended recipient.  Any review or distribution by others is 
strictly prohibited.  If you are not the intended recipient please contact
the sender and delete all copies.
========================================================

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Mon, 10 May 2004 11:24:43 +0200

> in the context of using CGAs to secure MIPv6 signalling.

So how does this help MIP?

> There is no point in having one address for ND security and another

Actually the objectives and requirements are slightly different so it's 
not completely without merit to consider having different mechanisms. 
But a unified one would be much, much, MUCH better.

For instance, for multi6 it is useful to be able to look up an 
identifier value to learn the associated locator values. Obviously this 
is going to be very hard, if not impossible, in a flat 59 bit space. 
That's why I proposed doing something that's otherwise quite similar to 
what's in the CGA draft using a site key rather than a host key, so 
that the number of values in the flat identifier space is limited to a 
number that isn't very different from the number of delegations in the 
largest DNS zones that exist today.

BTW, what's the implementation status of SEND/CGA?

---

From: "James Kempf" <[email-masked]>
Date: Mon, 10 May 2004 11:17:28 -0700

> BTW, what's the implementation status of SEND/CGA?

DoCoMo Labs did a full implementation of ndopt-00 on Linux. It isn't
publically available however.

Ive heard from at least one platform vendor who is interested in
implementing it.

On the other hand, I've also heard from one influential member of the KAME
community that they will not incorporate CGA into KAME because it has IPR on
it.

            jak

---

From: Pekka Nikander <[email-masked]>
Date: Tue, 11 May 2004 19:09:44 +0300

> community that they will not incorporate CGA into KAME because it has 

We implemented CGAs last summer on FreeBSD (and the code is available
upon request, as a 150 Mb full modified source tree), but didn't 
implement
the SEND parts.  Hence, if anybody is interested in implementing (and
preferably maintaining) a KAME patch, maybe our code could be used as
a partial starting point.

--Pekka