netdev - Re: Does the kernel IPv6 module plan to implement Secure Neighbor Discovery?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 16 Jan 2019 21:35:16 -0600
From:   ebiederm@...ssion.com (Eric W. Biederman)
To:     Ttttabcd <ttttabcd@...tonmail.com>
Cc:     Netdev <netdev@...r.kernel.org>
Subject: Re: Does the kernel IPv6 module plan to implement Secure Neighbor Discovery?

Ttttabcd <ttttabcd@...tonmail.com> writes:

> IPv6 is rapidly deploying globally. NDP replaces the role of ARP in IPv6 and provides mapping from IP address to MAC address.
>
> However, the NDP protocol is as insecure as the ARP protocol, and can be easily spoofed, and then the attacker can conduct man-in-the-middle attacks.
>
> The solution to the weak security problem is to use Secure Neighbor Discovery, Abbreviation, SeND.
>
> SeND uses Cryptographically Generated Addresses and public keys to authenticate information provided by NDP messages.
>
> I think SeND is a very important security facility under IPv6. I found some implementations in user space, but not in the kernel.
>
> I searched the mail records in lkml.org and found that no one was discussing SeND.
>
> So I am confused, is the kernel planning to implement SeND? Or should SeND be implemented in user space?

Usually it requires someone motivated to step up and do the work.  You
sound motivated.  The easiest thing would be for you to step up and
write the implementation.

Having looked at this once long ago my memory is that SeND only protects
against an attacker on a local lan.  That is not an attack scenario I am
particularly worried about.  If my memory is correct there are
additional issues with how you perform the initial key distribution.
All of which is why I am personally not interested.

But if you are interested and would like to make this happen more power
to you.

Eric