Subject: Re: Issue 14: Is CGA-only RD protection useful?

From: Greg Daley <[email-masked]>
Date: Mon, 08 Sep 2003 10:24:04 +1000

Hi James,

Sorry for my long delay in responding.

I think that we have to avoid using CGA only RAs
at all costs.

The issue is that the Host doesn't know that
the RA is genuine, rather than that the network
doesn't, therefore any solutions whereby devices
in the network access list RAs from known good CGA
sources do not address the issue:

That the RA doesn't contain enough information when
it arrives at the MN to guarantee its validity.

One difficulty comes in several wireless environements
where a host is on the same cell as an attacker and
the RA is visible directly from the wireless link.
While this is not necessarily unsolvable in current
wireless systems, it is irksome to have to worry about
wireless link effects in a security system.

More importantly, when a host moves to another cell
which doesn't support this filtering.  How do we know
that we're only receiving white-listed RAs?

The RA has to contain some authentication information
to communicate its authoritas to the host.

This is where the concept of Delegation Chains emerged
from in the first place.

Please don't put CGA only RAs into a solution.

I think it's a solution looking for a problem.

Greg
(I think that's a vote for A)

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Jari Arkko <[email-masked]>
Date: Mon, 08 Sep 2003 17:50:27 +0300

I don't really believe in the filtering approach. The main
reason in my opinion for the possible use of CGAs for RAs
would be the opportunistic security that was mentioned by
Julien. However, at this point we do not really have a
specific mechanism on the table to handle all the details
of this opportunistic scheme. We had some proposals before
the WG was formed, but nothing very detailed. Anyway, while
this is certainly useful, it is also something that we
could easily do later.

So here's what I would propose: I think in Vienna we
agreed that its OK to use CGA with certs for RAs, e.g. to
avoid stealing the other routers address. But for the CGA-only
case, we should leave it out from the spec. If we want
to, we can revisit this and create an "ad hoc network SEND
extension" later.

--Jari

---

From: "James Kempf" <[email-masked]>
Date: Wed, 10 Sep 2003 10:08:20 -0700

This issue generated lots of technical interesting technical discussion. I'd
like to suggest that we resolve the issue with Jari's proposal:

    avoid stealing the other router's address. But for the CGA-only

            jak