Jari Arkko
ABSTRACT
When IPv6 Neighbor and Router Discovery functions were defined, it was assumed that the local link would consist of mutually trusting nodes. However, the recent developments in public wireless networks, such as WLANs, have radically changed the situation. The nodes on a local link cannot necessarily trust each other any more, but they must become mutually suspicious even when the nodes have completed an authentication exchange with the network. This creates a number of operational difficulties and new security threats. In this paper we provide a taxonomy for the IPv6 Neighbor and Router Discovery threats, describe two new cryptographic methods, Cryptographically Generated Addresses (CGA) and Address Based Keys (ABK), and discuss how these new methods can be used to secure the Neighbor and Router discovery mechanisms.
- S. Deering and R. Hinden, Internet Protocol, Version 6 (IPv6) Specification, RFC2460, Internet Engineering Task Force, December 1998.]] Google Scholar
Digital Library
- A. Conta and S. Deering, Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification, RFC2463, Internet Engineering Task Force, December 1998.]] Google ScholarDigital Library
- IEEE Draft P802.1X/D11: Standard for Port based Network Access Control, LAN MAN Standards Committee of the IEEE Computer Society, March 27, 2001.]]Google Scholar
- IEEE Std. 802.11i/D2.0, Draft Supplement to IEEE 802.11 Standard: Specification for Enhanced Security, March 2002.]]Google Scholar
- A. Mishra and W. A. Arbaugh, "An Initial Security Analysis of the IEEE 802.1X Standard", UMIACS-TR-2002-10, University of Maryland, February 2002.]]Google Scholar
- R. M. Hinden and S. E. Deering. IP version 6 addressing architecture. RFC 2373, IETF Network Working Group, July 1998.]] Google ScholarDigital Library
- T. Narten, E. Nordmark and W. Simpson, Neighbor Discovery for IP Version 6 (IPv6), RFC2641, IETF, December 1998.]] Google ScholarDigital Library
- S. Thomson and T. Narten, IPv6 Stateless Address Autoconfiguration, RFC2462, Internet Engineering Task Force, December 1998.]] Google ScholarDigital Library
- T. Narten and R. Draves. Privacy extensions for stateless address autoconfiguration in IPv6. RFC 3041, IETF, January 2001.]] Google ScholarDigital Library
- J. Arkko, P. Nikander, T. Kivinen, and M. Rossi, Manual SA Configuration for IPv6 Link Local Messages, work in progress, draft-arkko-manual-icmpv6-sas-01.txt, June 2002.]]Google Scholar
- P. Nikander, "Denial-of-Service, Address Ownership, and Early Authentication in the IPv6 World," presented at Cambridge Security Protocols Workshop 2001, April 25-27, 2001, Cambridge University.]] Google ScholarDigital Library
- P. Nikander, "A Scalable Architecture for IPv6 Address Ownership", unpublished manuscript, available at http://www.tml.hut.fi/~pnr/publications/draft-nikander-ipng-pbk-addresses-00.txt, March 2001.]]Google Scholar
- D. Thaler and J. Hagino, "IPv6 Stateless DNS Discovery", draft-ietf-ipv6-dns-discovery-04.txt, work in progress.]]Google Scholar
- Steven Bellovin, "Security Problems in the TCP/IP Protocol Suite", Computer Communication Review, Vol. 19, No. 2, pp. 32--48, April 1989.]] Google ScholarDigital Library
- J. Kempf and E. Nordmark, "Threat Analysis for IPv6 Public Multi-Access Links," draft-kempf-netaccess-threats-00.txt,work in progress.]]Google Scholar
- Mankin, et. al., "Threat Models introduced by Mobile IPv6 and Requirements for Security in Mobile IPv6," draft-ietf-mobileip-mipv6-scrty-reqts-01.txt, work in progress.]]Google Scholar
- G. O'Shea and M. Roe, Child-proof authentication for MIPv6 (CAM). Computer Communications Review, April 2001.]] Google ScholarDigital Library
- G. Montenegro and C. Castellucia, "SUCV Identifiers and Addresses," draft-montenegro-sucv-02.txt, work in progress.]]Google Scholar
- J. Kempf, C. Gentry, and A. Silverberg, "Securing IPv6 Neighbor Discovery Using Address Based Keys (ABKs),"draft-kempf-ipng-secure-nd-00.txt, work in progress.]]Google Scholar
- A. Shamir, "Identity-Based Cryptosystems and Signature Schemes", Advances in Cryptology -Crypto'84, Lecture Notes in Computer Science 196, (1984), Springer, 47--53.]] Google ScholarDigital Library
- A. Fiat and A. Shamir, "How to prove yourself: Practical solutions to identification and signature problems", Advances in Cryptology - Crypto'86, Lecture Notes in Computer Science 263, 1986), Springer, 186--194.]] Google ScholarDigital Library
- U. Feige, A. Fiat, and A. Shamir, "Zero-knowledge Proofs of Identity", Journal of Cryptology 1, (1988), 77--94.]] Google ScholarDigital Library
- U. Maurer and Y. Yacobi, "Non-interactive public-key cryptography," Advances in Cryptology - Eurocrypt'92, Lecture Notes in Computer Science 658,(1993), Springer, 458--460.]]Google Scholar
- D. Boneh and M. Franklin, "Identity based encryption from the Weil pairing", Advances in Cryptology - Crypto 2001, LNCS 2139, (2001), Springer, 213--229, http://www.cs.stanford.edu/~dabo/papers/ibe.pdf]] Google ScholarDigital Library
- C. Cocks, "An identity based encryption scheme based on quadratic residues", http://www.cesg.gov.uk/technology/id-pkc/media/ciren.]]Google Scholar
- A. Silverberg and K. Rubin, "Supersingular abelian varieties in cryptography", Cryptology e- Print Archive Report 2002/006, http://eprint.iacr.org/2002/006/, Advances in Cryptography - Crypto 2002, Springer, 2002.]] Google ScholarDigital Library
- C. Gentry and A. Silverberg, "Hierarchical ID-based Cryptography," Cryptology e-Print Archive Report 2002/056, http://eprint.iacr.org/2002/056/.]]Google Scholar
Index Terms
- Securing IPv6 neighbor and router discovery
Recommendations
Detection of neighbor solicitation and advertisement spoofing in IPv6 neighbor discovery protocol
SIN '11: Proceedings of the 4th international conference on Security of information and networksWith the increase in number of hosts in the Internet, there is also a rise in the demand for IP address space. To cater to this issue, IP version 6 (IPv6) succeeded IPv4. Compared to 32 bit IP address space in IPv4, IP address in IPv6 is composed of 128 ...
Comments