Subject: [homenet] Please review security considerations of draft-homenet-babel-profile

From: Juliusz Chroboczek <[email-masked]>
Date: Tue, 25 Jul 2017 22:27:19 +0200

Dear all,

All security wizards are kindly requested to carefully read and if
necessary criticise the following section:

  https://tools.ietf.org/html/draft-ietf-homenet-babel-profile-02#section-4

Nasty comments on list, please, compliments by private mail ;-)

Thanks,

-- Juliusz

---

From: Stephen Farrell <[email-masked]>
Date: Tue, 25 Jul 2017 22:58:15 +0100

Hiya,

I suggest asking the chairs to hit the "request directorate" review
(iirc only they can see that button?) for an early secdir review.

For myself, I've not read the draft yet (I will over the next few
weeks) but have two questions while I'm here:

1) The first sentence seems to not say what to do if a packet comes
from a 1918 IPv4 address. Even if that's not supposed to happen, it
could be attempted. What's an implementation supposed to do then?

2) Again I need to read the rest of the draft, but does this mean
that anyone on that link of the homenet can inject these messages
without any authentication, and if so why is that ok? (I'm not
asking for now why doing better is too hard, just why it's ok for
any node on link to be able to play here.)

Cheers,
S.

On 25/07/17 21:27, Juliusz Chroboczek wrote:
> _______________________________________________
> homenet mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/homenet
>

---

From: Juliusz Chroboczek <[email-masked]>
Date: Wed, 26 Jul 2017 00:09:00 +0200

> could be attempted. What's an implementation supposed to do then?

Both HNCP and Babel use IPv6 for carrying control data.  There's no way an
IPv4 packet can be received by them (barring bugs, of course).  See also
REQ1 in this draft.

> without any authentication,

On the trusted link, yes.

> and if so why is that ok?

This draft takes no stand on whether it is okay or not, it merely states
the current security situation.  Defining cryptographic authentication
mechanisms for the Homenet stack is out of scope for this draft.

-- Juliusz

---

From: Ray Bellis <[email-masked]>
Date: Tue, 25 Jul 2017 23:19:10 +0100

> (iirc only they can see that button?) for an early secdir review.

Good idea - I've just done this.

Ray

---

From: Mark Baugher <[email-masked]>
Date: Tue, 25 Jul 2017 15:23:55 -0700

> On Jul 25, 2017, at 1:27 PM, Juliusz Chroboczek <[email-masked]> wrote:
> 
> Dear all,
> 

Based on this paragraph...
"If untrusted links are used for transit, which is NOT RECOMMENDED,
   and therefore need to carry HNCP and Babel traffic, then HNCP and
   Babel MUST be secured using an upper-layer security protocol.  While
   both HNCP and Babel support cryptographic authentication, at the time
   of writing no protocol for autonomous configuration of HNCP and Babel
   security has been defined."

...one might recommend starting with "an upper-layer security protocol"
such as CMS, COSE, JOSE or some other layer-3 encapsulation.  

Mark

---

From: Juliusz Chroboczek <[email-masked]>
Date: Wed, 26 Jul 2017 00:32:40 +0200

> such as CMS, COSE, JOSE or some other layer-3 encapsulation.  

We're planning to use DTLS for both HNCP and Babel.

But the authentication mechanism is not our main concern.  This being
Homenet, we need to generate keys automatically and distribute them
securely with little or no user intervention.  This is not trivial to do
right, and requires carefully balancing the tradeoffs between security and
usability.

-- Juliusz

---

From: Philip Homburg <[email-masked]>
Date: Wed, 26 Jul 2017 11:47:01 +0200

>Nasty comments on list, please, compliments by private mail ;-)

A trick used in some places, such as ND, is to require the receiver to check
that the hop limit is equal to 255. This ensures that the packet has not
been forwarded by any router (obviously the sender also has to send it with
a hop limit of 255).

Historically, a popular brand of router would forward packets with LL source.
So that cannot be considered safe in general.

---

From: Gert Doering <[email-masked]>
Date: Wed, 26 Jul 2017 20:49:10 +0200

Hi,

> Historically, a popular brand of router would forward packets with LL source.

"Historically"?  Has this been fixed?

Gert Doering
        -- NetMaster
-- 
have you enabled IPv6 on something today...?

SpaceNet AG                        Vorstand: Sebastian v. Bomhard
Joseph-Dollinger-Bogen 14          Aufsichtsratsvors.: A. Grundner-Culemann
D-80807 Muenchen                   HRB: 136055 (AG Muenchen)
Tel: +49 (0)89/32356-444           USt-IdNr.: DE813185279

---

From: Juliusz Chroboczek <[email-masked]>
Date: Wed, 26 Jul 2017 23:31:00 +0200

> been forwarded by any router (obviously the sender also has to send it with

Yeah, the so-called "TTL hack".  I considered that for Babel back when it
was being designed, then decided that it is useful in an IPv6 world.
Perhaps I was wrong, but at this stage it would break interoperability
with all existing Babel routers, which is not acceptable.

> Historically, a popular brand of router would forward packets with LL source.

Let's hope none of these historical routers will be used in a Homenet
environment.

-- Juliusz

---

From: Juliusz Chroboczek <[email-masked]>
Date: Wed, 26 Jul 2017 23:54:49 +0200

> was being designed, then decided that it is useful in an IPv6 world.

This was meant to say "not useful", of course.

---

From: Philip Homburg <[email-masked]>
Date: Thu, 27 Jul 2017 01:31:20 +0200

>"Historically"?  Has this been fixed?

I wanted to give them the benefit of the doubt. Sometimes they do fix a bug
and I didn't want to spend any time figuring out if this one was fixed or not.

---

From: Philip Homburg <[email-masked]>
Date: Thu, 27 Jul 2017 01:33:26 +0200

>Yeah, the so-called "TTL hack".  

Care to explain why it would not be useful?

---

From: Juliusz Chroboczek <[email-masked]>
Date: Thu, 27 Jul 2017 10:28:33 +0200

> Care to explain why it would not be useful?

At the time I wrote down Babel, I decided that given that we have link-local
addresses that are securely scoped to a single link, the TTL hack is not
necessary.

A workaround to the issue you describe would be to check the destination
address of Babel/HNCP packets in addition to the source address, and
rejecting a packet if the destination address is not in one of fe80::/64
or ff02::/112.  If we did that, would the TTL hack still hold any value?

-- Juliusz

---

From: Philip Homburg <[email-masked]>
Date: Thu, 27 Jul 2017 15:38:15 +0200

>addresses that are securely scoped to a single link, the TTL hack is not

The TTL hack is used in ND. It strikes me as really bad for security to come
up with a different mechanism to achieve the same result for no other reason
than that you for some reason didn't like that trick.

---

From: Gert Doering <[email-masked]>
Date: Thu, 27 Jul 2017 15:40:51 +0200

Hi,

On Thu, Jul 27, 2017 at 03:38:15PM +0200, Philip Homburg wrote:
> The TTL hack is used in ND. 

Because ND uses GUAs (which it should have never done in the first place).

> It strikes me as really bad for security to come

Relying on "it must be a link local src and link local dst" sounds much
more sane than "we permit arbitrary packets to reach us from the outside
and then worry about criteria to ignore them afterwards".

Gert Doering
        -- NetMaster