Subject: Overview of IPv6 first-hop issues and solutions - was: RE: IPv6 first-hop risks and threats and mitigations

From: Xipengxiao <[email-masked]>
Date: Fri, 18 Dec 2020 10:28:53 +0000

Hi Christopher,

Firstly I assume that by "work Fernando / Jen" you meant RA-guard(+) / Grand.  If you are talking about something else please let me know.  I want to make sure that we are talking about the same things.

With that assumption, my answer to your question is:

I think ND has some issues, e.g. (1) trust model - ND trust all messages (2) heavily utilizing multicast (3) not considering sleeping nodes (4) reactive not proactive.   This is because ND was designed many years ago when many things like smartphones, Wi-Fi didn't exist.  Fernando/Jen's works solved (1) & (4), Pascal's WiND (arguably) solved all these issues. But it changed ND fundamentally.  Should it be used only in wireless environment or both wireless & wired environment?  Recently Ole also published a P2P Ethernet draft to deal with (2).  Long story short, I don't think Fernando/Jen have solved all the issues.  There are many different solutions, each with its pros and cons.

Furthermore, first-hop protocols are more than ND.  There are also SLAAC, DHCPv6 etc.  They also have some unsolved issues.  Variable SLAAC, universal-ra-option-04 are examples to deal with those issues.

So in summary, I (and several other people in the WG) think there are issues in various first-hop protocols.  Some are solved, some are not.  For those solved issues, the solutions have pros and cons.  All of these are dispersed in many RFCs/drafts.  We believe it's helpful to summarize all the first-hop issues, and compare the solutions, in a single document.  This is just like Eric's draft-ietf-opsec-v6-21 summarize many IPv6 security issues into a single document.  We believe this would provide an opportunity for the WG to discuss the issues and existing solutions, and to decide the next steps.   For this reason, I've changed the subject to reflect our intention more accurately.  We in fact have a table of content reflecting some early thoughts of this work.  If anybody is interested please drop me a line.  We will send the TOC to you, and we welcome your participation.

Thanks and happy holidays to all!

XiPeng 

-----Original Message-----
From: Christopher Morrow [mailto:[email-masked]] 
Sent: Thursday, December 17, 2020 6:29 PM
To: Xipengxiao <[email-masked]>
Cc: Michael Richardson <[email-masked]>; Nabil Benamar <[email-masked]>; Pascal Thubert (pthubert) <pthubert=[email-masked]>; 6man Chairs <[email-masked]>; [email-masked]
Subject: Re: IPv6 first-hop risks and threats and mitigations

I thought this was work Fernando Gont / Jen Linkova already undertook... or had already taking some large steps to cover at any rate.
Were their docs not helpful here?

On Wed, Dec 16, 2020 at 3:37 PM Xipengxiao <[email-masked]> wrote:
>
> Hi Michael,
>
>
>
> >> So, the idea being to write down the issues, give the attacks names, and then clarify what defenses we have already and how well they work?
>
>
>
> Yes.  Are you interested in working on this together?  Happy holidays!
>
>
>
> XiPeng
>
>
>
> -----Original Message-----
> From: Michael Richardson [mailto:[email-masked]]
> Sent: Monday, November 23, 2020 1:24 AM
> To: Xipengxiao <[email-masked]>; Nabil Benamar 
> <[email-masked]>; Pascal Thubert (pthubert) 
> <pthubert=[email-masked]>; 6man Chairs 
> <[email-masked]>; [email-masked]
> Subject: IPv6 first-hop risks and threats and mitigations
>
>
>
>
>
> Xipengxiao <[email-masked]> wrote:
>
>     > I also think that it’s a good piece of work, and shouldn’t be given up.
>
>
>
>     > I would also like to take this opportunity to propose that the 
> WG start
>
>     > a “problem statement of IPv6 first-hop protocols” draft.  The 
> rationale
>
>     > is: many IPv6 first-hop protocols like ND, SLAAC were designed 
> long
>
>     > time ago; many things have changed over the years, e.g. the 
> advent of
>
>     > wireless, mobility, IoT, overlays;  lately there are multiple 
> drafts
>
>     > trying to fix various issues in a number of IPv6 first-hop 
> protocols,
>
>     > including:
>
>
>
> So, the idea being to write down the issues, give the attacks names, and then clarify what defenses we have already and how well they work?
>
>
>
> --
>
> Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
>
>            Sandelman Software Works Inc, Ottawa and Worldwide
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: Christopher Morrow <[email-masked]>
Date: Mon, 21 Dec 2020 13:29:05 -0500

> Firstly I assume that by "work Fernando / Jen" you meant RA-guard(+) / Grand.  If you are talking about something else please let me know.  I want to make sure that we are talking about the same th…

there's a set of things other than just ra-guard in their document lists.

> Furthermore, first-hop protocols are more than ND.  There are also SLAAC, DHCPv6 etc.  They also have some unsolved issues.  Variable SLAAC, universal-ra-option-04 are examples to deal with those i…

sure.

> So in summary, I (and several other people in the WG) think there are issues in various first-hop protocols.  Some are solved, some are not.  For those solved issues, the solutions have pros and co…

it'd be good to see perhaps a threat-analysis document and from that
smoe requirements discussion. as I noted in a different mail I guess
while whacking at fires around the camp fernando/jen have hit some
highlights, but there could be useful (threat analysis/etc) done still
and cleanup of the remaining problems.

---

From: Xipengxiao <[email-masked]>
Date: Tue, 22 Dec 2020 08:25:06 +0000

Hi Christopher,

>>  there's a set of things other than just ra-guard in their document lists.

Understood.  I used "RA-guard(+)" as an example.  There are also the SAVI related works.

>> it'd be good to see perhaps a threat-analysis document and from that smoe requirements discussion. as I noted in a different mail I guess while whacking at fires around the camp fernando/jen have hit some highlights, but there could be useful (threat analysis/etc) done still and cleanup of the remaining problems.

Good suggestion.  Will try to work out a skeleton during the holiday break and send to the ML.  Again, if anybody is interested in participating in this, please contact us.  So far we have Pascal, Eduard Metz, and myself.

Happy holidays and stay safe!

XiPeng 

-----Original Message-----
From: Christopher Morrow [mailto:[email-masked]] 
Sent: Monday, December 21, 2020 7:29 PM
To: Xipengxiao <[email-masked]>
Cc: Michael Richardson <[email-masked]>; Nabil Benamar <[email-masked]>; Pascal Thubert (pthubert) <pthubert=[email-masked]>; 6man Chairs <[email-masked]>; [email-masked]
Subject: Re: Overview of IPv6 first-hop issues and solutions - was: RE: IPv6 first-hop risks and threats and mitigations

sure.

> So in summary, I (and several other people in the WG) think there are issues in various first-hop protocols.  Some are solved, some are not.  For those solved issues, the solutions have pros and co…

it'd be good to see perhaps a threat-analysis document and from that smoe requirements discussion. as I noted in a different mail I guess while whacking at fires around the camp fernando/jen have hit some highlights, but there could be useful (threat analysis/etc) done still and cleanup of the remaining problems.

> Cc: Michael Richardson <[email-masked]>; Nabil Benamar 
> > IETF IPv6 working group mailing list [email-masked] Administrative 
> > Requests: https://www.ietf.org/mailman/listinfo/ipv6

---

From: Gyan Mishra <[email-masked]>
Date: Tue, 22 Dec 2020 09:22:52 -0500

On Tue, Dec 22, 2020 at 3:25 AM Xipengxiao <[email-masked]> wrote:

> smoe requirements discussion. as I noted in a different mail I guess while
> whacking at fires around the camp fernando/jen have hit some highlights,
> but there could be useful (threat analysis/etc) done still and cleanup of
> the remaining problems.
>
> Good suggestion.  Will try to work out a skeleton during the holiday break
> and send to the ML.  Again, if anybody is interested in participating in
> this, please contact us.  So far we have Pascal, Eduard Metz, and myself.

   Gyan> I would be interested in first hop IPv6 security.  This is a
critical topic for all operators.

> Cc: Michael Richardson <[email-masked]>; Nabil Benamar <
> [email-masked]>; Pascal Thubert (pthubert) <pthubert=
> [email-masked]>; 6man Chairs <[email-masked]>;
> [email-masked]
> Subject: Re: Overview of IPv6 first-hop issues and solutions - was: RE:
> IPv6 first-hop risks and threats and mitigations
>
> > Firstly I assume that by "work Fernando / Jen" you meant RA-guard(+) /
> Grand.  If you are talking about something else please let me know.  I want
> to make sure that we are talking about the same things.
> >
>
> > I think ND has some issues, e.g. (1) trust model - ND trust all messages
> (2) heavily utilizing multicast (3) not considering sleeping nodes (4)
> reactive not proactive.   This is because ND was designed many years ago
> when many things like smartphones, Wi-Fi didn't exist.  Fernando/Jen's
> works solved (1) & (4), Pascal's WiND (arguably) solved all these issues.
> But it changed ND fundamentally.  Should it be used only in wireless
> environment or both wireless & wired environment?  Recently Ole also
> published a P2P Ethernet draft to deal with (2).  Long story short, I don't
> think Fernando/Jen have solved all the issues.  There are many different
> solutions, each with its pros and cons.
> >
> > Furthermore, first-hop protocols are more than ND.  There are also
> SLAAC, DHCPv6 etc.  They also have some unsolved issues.  Variable SLAAC,
> universal-ra-option-04 are examples to deal with those issues.
> >
>
> sure.
>
> > So in summary, I (and several other people in the WG) think there are
> issues in various first-hop protocols.  Some are solved, some are not.  For
> those solved issues, the solutions have pros and cons.  All of these are
> dispersed in many RFCs/drafts.  We believe it's helpful to summarize all
> the first-hop issues, and compare the solutions, in a single document.
> This is just like Eric's draft-ietf-opsec-v6-21 summarize many IPv6
> security issues into a single document.  We believe this would provide an
> opportunity for the WG to discuss the issues and existing solutions, and to
> decide the next steps.   For this reason, I've changed the subject to
> reflect our intention more accurately.  We in fact have a table of content
> reflecting some early thoughts of this work.  If anybody is interested
> please drop me a line.  We will send the TOC to you, and we welcome your
> participation.
> >
>
> it'd be good to see perhaps a threat-analysis document and from that smoe
> requirements discussion. as I noted in a different mail I guess while
> whacking at fires around the camp fernando/jen have hit some highlights,
> but there could be useful (threat analysis/etc) done still and cleanup of
> the remaining problems.
>
> > I thought this was work Fernando Gont / Jen Linkova already undertook...
> or had already taking some large steps to cover at any rate.
> > > >> So, the idea being to write down the issues, give the attacks
> names, and then clarify what defenses we have already and how well they
> work?
> > >
> > >
> > >
> > > So, the idea being to write down the issues, give the attacks names,
> and then clarify what defenses we have already and how well they work?
> > >
> > >
> > >
> > > --
> > >
-- 

<http://www.verizon.com/>

*Gyan Mishra*

*Network Solutions A**rchitect *

*M 301 502-134713101 Columbia Pike *Silver Spring, MD