Subject: Securing Neighbor Discovery BOF

From: "James Kempf" <[email-masked]>
Date: Fri, 7 Jun 2002 01:32:56 -0700

On Tues. afternoon of IETF 54 13:00-14:00, there will be a BOF held to
discuss securing Neighbor Discovery. The BOF description, along with a
suggested reading list, will appear when the agenda is posted on the
IETF 54 Web page. If you are interested in this problem, please attend.
If you would like to speak, please send email to me or Pekka Nikkander
([email-masked]).

            jak

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Fri, 7 Jun 2002 11:51:52 +0300 (EEST)

> ([email-masked]).

Are there any non-encumbered technologies to Secure ND?

Thought so...

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Jari Arkko <[email-masked]>
Date: Fri, 07 Jun 2002 15:12:01 +0300

> Are there any non-encumbered technologies to Secure ND?

IP Security, for one. The current IPsec can be used, though
it's pretty cumbersome due to (a) large number of similar SAs
needed for manual keying due to destination address being a
part of SA lookup and (b) chicken-and-egg problem for IKE.
The problem (a) could be solved, and the result would be a
more easily usable IPsec for securing large private networks.
For public networks manual keying does not scale, however.
Perhaps something can be done for (b). For instance, one
possible, even if ugly, solution is to provide an ND-level
message to carry IKE-like traffic between the ND
peers until an IPsec SA can be established. Contributions
on this space are sought -- feel free to jump in here ;-)

Then there are ABK and CGA-based techniques.

Anyway, I'm not sure we at this point have all the solutions.
If we agree the issue is a problem, the group will figure out
the possible solutions and their pros and cons. (IPRs are
likely to be taken in account.)

Jari

---

From: "James Kempf" <[email-masked]>
Date: Sat, 8 Jun 2002 23:44:17 -0700

> on this space are sought -- feel free to jump in here ;-)

Key distribution could be done via Layer 2 AAA or using the roaming
consortia idea we had in the ABK draft. However, I think that might
require some change in IPsec policy, because I believe the policy only
allows IKE or manual keying for key distribution.

            jak

---

From: "James Kempf" <[email-masked]>
Date: Sat, 8 Jun 2002 23:40:39 -0700

Pekka,

We will shortly be releasing the ABK draft with a statement like the
Photuris statement, which was included in IKE.

Also, some people believe that IPsec will work. If some way can be found
around the keying problem, it could be a viable alternative.

            jak

---

From: Jari Arkko <[email-masked]>
Date: Sun, 09 Jun 2002 22:12:51 +0300

> Photuris statement, which was included in IKE.

Sounds interesting!

> around the keying problem, it could be a viable alternative.

There may be ways around some of the problems, in the way that my previous
e-mail outlined. However, generally speaking you will end up with a solution
that separates good guys from the bad guys. But it isn't necessarily going to
be able to indicate which ones of the "good guys" can use which IP addresses.
This may or may not be sufficient, depending on who you ask.

Jari
P.S. There's also a separate e-mail list set up for the discussions. Send
e-mail to [email-masked] with the text "subscribe"
in the body to join. The name of the list is "SEND" for Secure
Neighbour Discovery.

---

From: Jari Arkko <[email-masked]>
Date: Sun, 09 Jun 2002 22:12:51 +0300

Sounds interesting!

Jari