Subject: RE: node-to-node security breach

From: "Karen E. Nielsen (AH/TED)" <[email-masked]>
Date: Tue, 24 Aug 2004 07:39:30 +0200

Hi Pekka,

> -----Original Message-----
> From: Pekka Savola [mailto:[email-masked]]
> Sent: Tuesday, August 24, 2004 7:19 AM
> To: Karen E. Nielsen (AH/TED)
> Cc: [email-masked]
> Subject: Re: node-to-node security breach
> 
> 
> On Mon, 23 Aug 2004, Karen E. Nielsen (AH/TED) wrote:
> > > I'm not sure if I understand your comment.  I wasn't arguing for
> > > node-to-node communication :) -- I was just pointing out that the
> > > mitigation strategy simply doesn't work, so the document 
> should say
> > > that direct tunneling issues cannot be mitigated (that 
> way) because it
> > > would break the protocol.  Either the protocol must not 
> have direct
> > > tunneling, or the risks must always be acceptable.
> > 
> > 
> > The essence here is that direct tunnelling isn't an explicit goal
> > of zeroconf wherefore it isn't discussed in any detail 
> > (and thats made perfectly clear).
> > 
> > But now that you bring it up we can say something 
> > to this effect in the security section 
> > - something like:
> > 
> > "Direct Tunnelling:
> > 
> > If in addition direct tunnelling is provided, 
> > the tunnel protocol should not impose any new vulnerability to the
> > nodes implementing the tunnel protocol than what is already present
> > in existing IPv6 networks, where multiple hosts are served by the
> > same router (possible multiple routers).
> > 
> > Note that the mitigation strategy
> > discussed above would break direct tunnelling,
> > etc. etc."
> > 
> > I don't know if the other authors agree, but would this 
> > mitigate your concerns ?
> 
> No that wouldn't be good.  The point is that it does not just break
> *direct tunneling*, but it breaks node-to-node communication inside
> the "direct tunneling range".  That is unacceptable, and therefore 
> such mitigation should not be listed.
> 

I think (?) that we agree on the following:

* If the protocol operate with host-to-server communication only, then
the mitigation scheme would work, and it wouldn't break anything.

* It must be said that the mitigation scheme would break direct tunnelling,
wherefore it cannot be applied when direct tunnelling is invoked by the protocol.

I don't, however, understand the distinction you seem to make here, nor do I understand
what it is you to be find unacceptable - could you please elaborate ?

Thanks, Karen

---

From: Pekka Savola <[email-masked]>
Date: Tue, 24 Aug 2004 08:58:24 +0300 (EEST)

On Tue, 24 Aug 2004, Karen E. Nielsen (AH/TED) wrote:
> * If the protocol operate with host-to-server communication only,
> then the mitigation scheme would work, and it wouldn't break
> anything.

Sure, but if the protocol operates entirely in host-to-server (and 
server-to-host), there is nothing to mitigate in the first place, as 
the protocol implementation would automatically discard the bogus 
proto-41 packets in the first place?

> * It must be said that the mitigation scheme would break direct
> tunnelling, wherefore it cannot be applied when direct tunnelling is
> invoked by the protocol.
> 
> I don't, however, understand the distinction you seem to make here,
> nor do I understand what it is you to be find unacceptable - could
> you please elaborate ?

I think you probably said it sufficiently well in above.

What I mean is that one could envision three different approaches:

 1) no direct tunneling in the protocol -- nothing to mitigate
 2) direct tunneling in the protocol, but it could be turned off.  This 
    would not work with the current protocols, because there can be 
    hosts in the direct tunneling range which try to use direct 
    tunneling for node-to-node communication, and then node to node 
    communication would fail.
 3) direct tunneling in the protocol, and it is used.

The point I tried to make is that *node-to-node* communication is a
strict requirement: we must not break that.  On the other hand,
*direct tunneling* is not a requirement, and we could do without it,
but we must not break node-to-node communication while doing so.

For example, if we take ISATAP, we cannot remove (AFAICS) direct
tunneling in a manner which would not break node-to-node communication
without making non-interoperable changes to the protocol (e.g.,
defining a new identifier instead of "5efe").

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings