Subject: [savi] A "nonce" field seems neccessary in SAVI-SEND entry

From: "Guang Yao" <[email-masked]>
Date: Tue, 9 Nov 2010 16:29:13 +0800

Hi, Marcelo and Alberto

It seems necessary to contain "nonce" field in SAVI-SEND binding entry to
prevent replay attack, as LCFS principle is used.

BR,

Guang

---

From: "Bi Jun" <[email-masked]>
Date: Tue, 9 Nov 2010 17:22:14 +0800

Suggest to state this at savi-send draft.

Thanks,
Jun

From: Guang Yao 
Sent: Tuesday, November 09, 2010 4:29 PM
To: 'SAVI Mailing List' 
Subject: [savi] A "nonce" field seems neccessary in SAVI-SEND entry

Hi, Marcelo and Alberto

It seems necessary to contain “nonce” field in SAVI-SEND binding entry to prevent replay attack, as LCFS principle is used.

BR,

Guang

--------------------------------------------------------------------------------
_______________________________________________
savi mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/savi

---

From: Alberto García <[email-masked]>
Date: Tue, 9 Nov 2010 11:59:42 +0100

Hi Guang and Jun,

SEND already has anti-replay protection measures, including nonce exchange for advertisements in response to solicitation, and timestamp to validate solicitations and unsolicited advertisements. Since SEND SAVI devices follow SEND validation rules, nonce and timestamps are checked appropriately.

However, going in more detail into anti-replay protection provided by SAVI SEND, we have to consider that there are only two situations in which bindings are created/refreshed: as a result of a DAD_NSOL and as a result of a NUD_NSOL/NUD_NADV exchange. 

For the DAD_NSOL case, protection against replay attacks comes from the fact that this DAD_NSOL is not propagated to ports in which a previous binding existed. Therefore, nodes connected to other ports will not be able to replay the packet. Note that the timestamp protection provided by SEND may not be useful in this case, since a fast replay would be within the time variations allowed by SEND when checking timestamps. But the protection provided by not sending the DAD_NSOL to every port is enough protection.

The NUD_NSOL/NUD_NADV is protected by the SEND nonce. 

This is stated in more detail in the ‘Security Considerations’ section of draft-ietf-savi-send-04.

Do you think there is any residual vulnerability?

Regards,

Alberto

De: [email-masked] [mailto:[email-masked]] En nombre de Bi Jun
Enviado el: martes, 09 de noviembre de 2010 10:22
Para: Guang Yao; 'SAVI Mailing List'
Asunto: Re: [savi] A "nonce" field seems neccessary in SAVI-SEND entry

Thanks,

Jun

From: Guang Yao <mailto:[email-masked]>  

To: 'SAVI Mailing List' <mailto:[email-masked]>  

Hi, Marcelo and Alberto

BR,

Guang

  _____

---

From: "Guang Yao" <[email-masked]>
Date: Tue, 9 Nov 2010 20:02:54 +0800

Thank you for your reply. I can understand that the SAVI--SEND device is also a SEND node, thus no need to specify fundamental requirements of SEND.

However, another question, what do you mean by “ports in which a previous binding existed”?

BR

Guang

From: Alberto García [mailto:[email-masked]] 
Sent: Tuesday, November 09, 2010 7:00 PM
To: 'Bi Jun'; 'Guang Yao'; 'SAVI Mailing List'
Subject: RE: [savi] A "nonce" field seems neccessary in SAVI-SEND entry

Hi Guang and Jun,

Regards,

Alberto

Thanks,

Jun

Hi, Marcelo and Alberto

BR,

Guang

  _____

---

From: Alberto García <[email-masked]>
Date: Wed, 10 Nov 2010 11:53:02 +0100

Hi,

I meant that in general, when a SAVI device receives a DAD_NSOL message from a Validating port for which a binding does not exist (i.e. a Validating port currently not included in the SEND SAVI Port list), it forwards the message to the appropriate Trusted ports, and only to the only Validating port for which a binding may exist, if this is the case. In addition, if a SAVI device receives a DAD_NSOL from a Trusted port, it again forwards it to the appropriate Trusted ports, and to the only Validating port for which a binding may exist, if this is the case. 

Regards,

Alberto

De: [email-masked] [mailto:[email-masked]] En nombre de Guang Yao
Enviado el: martes, 09 de noviembre de 2010 13:03
Para: 'Alberto García'; 'Bi Jun'; 'SAVI Mailing List'
Asunto: Re: [savi] A "nonce" field seems neccessary in SAVI-SEND entry

BR

Guang

Hi Guang and Jun,

Regards,

Alberto

Thanks,

Jun

Hi, Marcelo and Alberto

BR,

Guang

  _____