Subject: RE: IPv6 first-hop risks and threats and mitigations

From: Xipengxiao <[email-masked]>
Date: Wed, 16 Dec 2020 20:37:19 +0000

Hi Michael,

>> So, the idea being to write down the issues, give the attacks names, and then clarify what defenses we have already and how well they work?

Yes.  Are you interested in working on this together?  Happy holidays!

XiPeng

-----Original Message-----
From: Michael Richardson [mailto:[email-masked]]
Sent: Monday, November 23, 2020 1:24 AM
To: Xipengxiao <[email-masked]>; Nabil Benamar <[email-masked]>; Pascal Thubert (pthubert) <pthubert=[email-masked]>; 6man Chairs <[email-masked]>; [email-masked]
Subject: IPv6 first-hop risks and threats and mitigations

Xipengxiao <[email-masked]<mailto:[email-masked]>> wrote:

    > I also think that it’s a good piece of work, and shouldn’t be given up.

    > I would also like to take this opportunity to propose that the WG start

    > a “problem statement of IPv6 first-hop protocols” draft.  The rationale

    > is: many IPv6 first-hop protocols like ND, SLAAC were designed long

    > time ago; many things have changed over the years, e.g. the advent of

    > wireless, mobility, IoT, overlays;  lately there are multiple drafts

    > trying to fix various issues in a number of IPv6 first-hop protocols,

    > including:

So, the idea being to write down the issues, give the attacks names, and then clarify what defenses we have already and how well they work?

--

Michael Richardson <[email-masked]<mailto:[email-masked]>>   . o O ( IPv6 IøT consulting )

           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Christopher Morrow <[email-masked]>
Date: Thu, 17 Dec 2020 12:28:47 -0500

I thought this was work Fernando Gont / Jen Linkova already
undertook... or had already taking some large steps to cover at any
rate.
Were their docs not helpful here?

On Wed, Dec 16, 2020 at 3:37 PM Xipengxiao <[email-masked]> wrote:
> Xipengxiao <[email-masked]> wrote:
>
> Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------

---

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Fri, 18 Dec 2020 15:59:11 +0000

You got me confused Christopher. 

Both Jen and Fernando are quite prolific, and I see many point solutions, but I do not see a problem statement such as the one Xipeng is proposing. Would you have a pointer to the doc(s) you have in mind.

With a larger view, one may derive a different set of solutions that may be more work but still worthwhile with respect to the amount of issues that this could solve.

Enjoy the break!

pascal

> From: Christopher Morrow <[email-masked]>
> Sent: jeudi 17 décembre 2020 18:29
> To: Xipengxiao <[email-masked]>
> Cc: Michael Richardson <[email-masked]>; Nabil Benamar
> <[email-masked]>; Pascal Thubert (pthubert) <[email-masked]>;
> 6man Chairs <[email-masked]>; [email-masked]
> Subject: [SUSPECTED SPAM] Re: IPv6 first-hop risks and threats and
> mitigations
> 
> I thought this was work Fernando Gont / Jen Linkova already undertook... or
> had already taking some large steps to cover at any rate.
> > >> So, the idea being to write down the issues, give the attacks names, and
> then clarify what defenses we have already and how well they work?
> >
> >
> >
> > To: Xipengxiao <[email-masked]>; Nabil Benamar
> > <[email-masked]>; Pascal Thubert (pthubert)
> > <pthubert=[email-masked]>; 6man Chairs
> > <[email-masked]>; [email-masked]
> > So, the idea being to write down the issues, give the attacks names, and
> then clarify what defenses we have already and how well they work?
> >
> >
> >
> > --
> >

---

From: Christopher Morrow <[email-masked]>
Date: Mon, 21 Dec 2020 13:26:56 -0500

> You got me confused Christopher.

or completely possible I'm confused :)

> Both Jen and Fernando are quite prolific, and I see many point solutions, but I do not see a problem statement such as the one Xipeng is proposing. Would you have a pointer to the doc(s) you have i…

I had thought fernando/jen's set of documents pushed forth a basic set
of protections (or possible protections) for IPv6 hosts, things like:
  filtering the right set of icmp type/code
  filtering of fragments in the wide area
  inability to use certain header types (due to similar filtering problems)

a quick look through their author profiles:
  https://datatracker.ietf.org/person/Fernando%20Gont
  https://datatracker.ietf.org/person/[email-masked]

shows a raft of documents related to host/network problems with ipv6.
I suppose: "Yes there is no overarching architecture, design,
implementation, threat-analysis, requirements document set for this"
(nor something that walks readers through the published documents and
shows where gaps may be (or what gaps these documents patch)

> With a larger view, one may derive a different set of solutions that may be more work but still worthwhile with respect to the amount of issues that this could solve.

sure!