Subject: Re: [dhcwg] Renumbering Requirements for Stateless DHCPv6

From: Ted Lemon <[email-masked]>
Date: Thu, 4 Mar 2004 07:33:06 +0900

On Mar 3, 2004, at 5:10 PM, Changming Liu wrote:
> We use multicast address
> in many places such as RA, why not here?

Here multicast reconfigure opens you up to an easy amplification attack 
- a single packet from the attacker can produce dozens, hundreds or 
thousands of packets on the server in short succession, depending on 
your network configuration.   So it's very much worth avoiding.

Multicast reconfigure also creates a serious risk in the sense that an 
attacker can disrupt all of the clients on your network very quickly 
and easily, whereas if you don't support multicast reconfigure the 
attacker can't get the information it needs to succeed with an attack 
of this type.

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: Changming Liu <[email-masked]>
Date: Wed, 3 Mar 2004 00:10:07 -0800

Mat, 

>I don't agree at all. There is no requirement to work in the event of
unplanned events - it would be nice, but I don't agree that it is
required. There will always be breakage in the case of unplanned events,
which is precisely why operators try to avoid them. I think we are
deluded if we think that there is a solution out there that could be
guaranteed to work in the case of an unplanned event. Given that,
lifetimes are necessary and sufficient in my opinion.

Changming: If you have read the draft, in both sectin 2 (problem statement)
and section 4 (renumbering requirement) state it very clearly and I agree
100% with. Here is the quote fom the draft in case you don't have access:

The unplanned renumbering event, which may be more common in smaller,
   unmanaged networks, is more difficult to cater for.   Ideally, any
   solution for the problem should consider planned and unplanned
   events

> For reconfig, we already have one defined, but unicast only. 
> So the infrastruture should be there.

Why require infrastructure when it isn't necessary?

Changming: That's not my point. My point is whatever infrastruture needed to
support the unicast reconfigure message will be reused for multiast. The
unicast RECONFIGURE message is defined in RFC 3315 section 15.11.
 
>  It only problem is it's unicast which does not scale well. 
> The problem is well defined in this draft and no need to repeat here.

Unicast doesn't scale and multicast is difficult to secure - that's the
bind that reconfig is in.

Changming: true statement and in general I agree. "Two advantages of IPv6
are that support for multicast is required and nodes can create link-local
addresses during initialization. " from RFC 3315 section 3. If multicast is
not secure, why don't we abandon it all together? We use multicast address
in many places such as RA, why not here?

Mat