netdev - Does the kernel IPv6 module plan to implement Secure Neighbor Discovery?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CDlkrtj-oyA7FP7gtylQ8YrFJrfCwfBclB56T4e3I1tXOp-3JI3rYUMDZ6IkhlNYOL0qEhRCRiLSN417-kVhY59hiJttunS6_fMtERQttVs=@protonmail.com>
Date:   Mon, 14 Jan 2019 16:21:10 +0000
From:   Ttttabcd <ttttabcd@...tonmail.com>
To:     Netdev <netdev@...r.kernel.org>
Subject: Does the kernel IPv6 module plan to implement Secure Neighbor Discovery?

IPv6 is rapidly deploying globally. NDP replaces the role of ARP in IPv6 and provides mapping from IP address to MAC address.

However, the NDP protocol is as insecure as the ARP protocol, and can be easily spoofed, and then the attacker can conduct man-in-the-middle attacks.

The solution to the weak security problem is to use Secure Neighbor Discovery, Abbreviation, SeND.

SeND uses Cryptographically Generated Addresses and public keys to authenticate information provided by NDP messages.

I think SeND is a very important security facility under IPv6. I found some implementations in user space, but not in the kernel.

I searched the mail records in lkml.org and found that no one was discussing SeND.

So I am confused, is the kernel planning to implement SeND? Or should SeND be implemented in user space?