Subject: RE: Identifiers

From: "Fleischman, Eric" <[email-masked]>
Date: Wed, 24 Mar 2004 12:54:38 -0800

From: marcelo bagnulo [mailto:[email-masked]] wrote:
>The point is that if we care about destination addresses being genuine, we
>may also need to care about source addresses being genuine, depending on the
>sense of direction that the considered solution has. I mean, if the source
>address of established communications will be used as destiantion address
>for following communcations, if an attacker succeed in convincing a victim
>that IPA is one of its source addresses, following communications
>established by the victim to IPA will be routed to the attacker.

This point resonates with me. 

Also, if it were possible today to know that the source IP address were a 
genuine IP address, then that would strengthen a deployment's security posture. 
That is, today we can't know if many attacks are using spoofed addresses or not. 
However, if we could know that the source address was not valid, then we could 
identify that packet as being an attack and discard/ignore it (e.g., during a 
(D)DoS attack). Our security posture would be further improved if we could know 
that the claimed sender did indeed send that packet (i.e., non-repudiation; i.e., 
knowing whether a genuine address was being spoofed or not). 

Changing topics, I am confused (perhaps because I am a newbie on this list) 
by the earlier discussion about authentication and authorization. I
would have thought that we would be using IPSec (whether AH or ESP) for 
situations requiring authentication at the network layer. Is there a reason
why we aren't use IPSec but rather need an alternative network layer provision?

---

From: "marcelo bagnulo" <[email-masked]>
Date: Thu, 25 Mar 2004 10:05:08 +0100

Hi Erik,

> genuine IP address, then that would strengthen a deployment's

Well, the multi6 problem is already pretty difficult as it is, so i would
say that achieving additional goals like what you are mentioning is a plus
but it is not a requirment.

> why we aren't use IPSec but rather need an alternative network

HIP uses IPSec ESP headers, but some others solutions use alternative
formats, for optimization, for instance

Regards, marcelo

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Thu, 25 Mar 2004 10:45:12 +0100

> genuine IP address, then that would strengthen a deployment's security 

So what's a genuine IP address? As opposed to a cheap knockoff?  :-)

> That is, today we can't know if many attacks are using spoofed 
> addresses or not. However, if we could know that the source address 
> was not valid, then we could identify that packet as being an attack 
> and discard/ignore it (e.g., during a (D)DoS attack).

These days people rarely take the trouble to fake the source address in 
DoS attacks. The real problem here is that sources get to send traffic 
without any means for the recipient to shut them up. So what we need is 
a way to determine whether the recipient is prepared to receive certain 
traffic. I came up with a way to do just that a while ago but I haven't 
written it down as a draft yet. The quick version:

The idea is that a service provider does proxy IPsec AH verification on 
behalf of the recipient. The key used for computing the AH header is a 
hash of the SPI, the source and destination addresses and a secret that 
is known to the service provider and the recipient, but not the sender. 
The sender only gets to know the key that is particular to the 
negotiated SPI, but the service provider only has to maintain a 
relatively small list of recently invalidated SPIs and the shared 
secret and can check the packets coming in from all senders. The 
recipient hands out SPIs/keys to senders and invalidates SPIs when 
senders do stuff they're not supposed to do and then doesn't give them 
a new one.

> Our security posture would be further improved if we could know
> that the claimed sender did indeed send that packet (i.e., 
> non-repudiation; i.e., knowing whether a genuine address was being 
> spoofed or not).

Sounds like a job for IPsec.

> I would have thought that we would be using IPSec (whether AH or ESP) 
> for

We don't want to have AH or ESP headers in all packets because of the 
overhead. This is something like 24 bytes per packet minimum, making 
the overhead of our multihoming scheme + IPv6 more than double that of 
IPv4 (multihomed or otherwise). There are also deployment issues: how 
many people are talking IPsec to strangers today?

---

From: Brian E Carpenter <[email-masked]>
Date: Thu, 25 Mar 2004 10:55:34 +0100

> Hi Erik,
...
> formats, for optimization, for instance

At the moment we are trying to reach an architectural view - i.e. what do
we need to authenticate, if anything? Whether we use HIP or IPSEC is a
solution-space choice, for a little bit later.

   Brian