Subject: [savi] 回复: Re: A few comments回复: [Fwd: I-D Action:draft-bagnulo-savi-fcfs-01.txt]

From: ZhangDong <[email-masked]>
Date: Wed, 04 Feb 2009 17:21:00 +0800

Sorry for the delay.

>  >>   be stronger than that.  On the other hand, if we use switch 
> ports as
>  >>   lower layer anchors (and there is only one host connected to each
>  >>   port) it is likely that the resulting SAVI solution will be
>  >>   considerably more secure.
>  >>     
>  > In my opinion, the security of the layer  2 anchor should be 
> considered in SAVI.
>  
>  i agree with this
>  
>  The proposal so far would be to have a defualt layer 2 anchor, which
>  could be the ports on switch for instance, to descibe the savi mechanism
>  in the document and then to have a appendix at the end of the doucment
>  considering the different layer 2 anchors and make considerations about
>  each of them, does this sounds like a reasonable approahc to you?
>  

It sounds useful. Is it necessary to introduce the concrete scenarios of the savi mechnism? Starting an informational draft?

>  >  The SAVI device should not rely on other mechnisms to protect its 
> reliability.
>  >   
>  but, by definition this is the case... I mean, so far, the savi will
>  perform a bindiong between the IP address and the lower layer anchor.
>  An attacker has two possibel attack vectors. He can either try to create
>  a false binding or it can spoof the layer 2 anchor that is contained 
> in
>  the binding. The security of savi will be equivalent to the lower
>  security of these two. So, depending on the lower layer anchor is
>  selected, the security of savi will vary
>  
>  > Maybe the SAVI device could check the MAC in the packet before 
> creating the entry by enquiring whether the MAC is used or a 
> legitimate one.
>  >   
>  
>  but how do you do that?

For instance, after receiving a packet from some node, the savi device may send a Neighbor Unreachability Detection message to the node by its MAC. Succeed, create an entry in the DB. Or, the MAC in the packet may be forged, and the savi device drops the packet.
What do you think about?

Best regards

Dong

>  
>  regards, marcelo
>  
>  
>  > What is the opinion of others?
>  >
>  > best Regards,
>  >
>  > Dong Zhang
>  >
>  >
>  > ----- 原始邮件 -----
>  > 发件人: marcelo bagnulo braun <[email-masked]>
>  > 日期: 2009年 1月 23日, 星期五,  上午2:10
>  > 主题: [savi] [Fwd: I-D Action:draft-bagnulo-savi-fcfs-01.txt]
>  > 收件人: SAVI Mailing List <[email-masked]>
>  >
>  >
>  >   
>  >> Hi,
>  >>  
>  >>  we have submitted a new version of the draft trying to address 
> the 
>  >>  received comments.
>  >>  This new version includes the usage of DAD and ACD to create SAVI 
> 
>  >>  bindings and has an initial version of the security 
> considerations, 
>  >>  describing the DoS attacks countermeasures.
>  >>  
>  >>  Comments are appreciated,
>  >>  
>  >>  regards, marcelo
>  >>  
>  >>  
>  >>  -------- Mensaje original --------
>  >>  Asunto: 	I-D Action:draft-bagnulo-savi-fcfs-01.txt
>  >>  Fecha: 	Thu, 22 Jan 2009 10:00:01 -0800 (PST)
>  >>  De: 	[email-masked]
>  >>  Responder a: 	[email-masked]
>  >>  Para: 	[email-masked]
>  >>  
>  >>  
>  >>  
>  >>  A New Internet-Draft is available from the on-line 
> Internet-Drafts directories.
>  >>  
>  >>  	Title           : First-Come First-Serve Source-Address 
> Validation Implementation
>  >>  	Author(s)       : E. Nordmark, M. Bagnulo
>  >>  	Filename        : draft-bagnulo-savi-fcfs-01.txt
>  >>  	Pages           : 14
>  >>  	Date            : 2009-01-22
>  >>  
>  >>  This memo describes FCFS SAVI a mechanism to provide source address
>  >>  validation for IPv4 and IPv6 networks using the First-Come First-
>  >>  Serve approach.  The proposed mechanism is intended to complement
>  >>  ingress filtering techniques to provide a higher granularity on the
>  >>  control of the source addresses used.
>  >>  
>  >>  A URL for this Internet-Draft is:
>  >>  http://www.ietf.org/internet-drafts/draft-bagnulo-savi-fcfs-01.txt
>  >>  
>  >>  Internet-Drafts are also available by anonymous FTP at:
>  >>  ftp://ftp.ietf.org/internet-drafts/
>  >>  
>  >>  Below is the data which will enable a MIME compliant mail reader
>  >>  implementation to automatically retrieve the ASCII version of the
>  >>  Internet-Draft.
>  >>  
>  >>  
>  >>  
>  >> _______________________________________________
>  >>  I-D-Announce mailing list
>  >>  [email-masked]
>  >>  https://www.ietf.org/mailman/listinfo/i-d-announce
>  >>  Internet-Draft directories: http://www.ietf.org/shadow.html
>  >>  or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>  >>  
>  >>  
>  >> _______________________________________________
>  >>  savi mailing list
>  >>  [email-masked]
>  >>  https://www.ietf.org/mailman/listinfo/savi
>  >>  
>  >>     
>  >
>  >   
>  
>

---

From: marcelo bagnulo braun <[email-masked]>
Date: Wed, 04 Feb 2009 13:06:30 +0100

> For instance, after receiving a packet from some node, the savi device may send a Neighbor Unreachability Detection message to the node by its MAC. Succeed, create an entry in the DB. Or, the MAC i…
but if the attacker has forged the MAC it will be able to reply to the
NUD msg, right?

I fail to see what additional defense is achieved with this... perhaps
you could describe an attack that is prevented with this technique?

regards, marcelo