v6 subnet size for DSL & leased line customers
Iljitsch van Beijnum
iljitsch at muada.com
Wed Dec 26 20:19:54 UTC 2007
On 26 dec 2007, at 19:22, Tony Li wrote:
> This doesn't resolve the real underlying problem: Ethernet is
> inherently insecure. MAC addresses can be forged, protocols (ARP,
> ND) can be forged and at this point, there's not much that we can do
> about it. Architecturally, we need authentication over each and
> every control plane packet sent. Getting there without invoking the
> full complexity of a public key infrastructure is still an unsolved
> problem, AFAIK.
Actually, for this particular purpose, this is mostly a solved
problem, although there is of course no free lunch.
Many switches can enforce a MAC/port relationship, so that MAC
addresses can't be spoofed.
Neighbor discovery and router advertisements can be secured with SEND
(SEcure Neighbor Discovery). This happens through CGAs,
cryptograpically generated addresses. Basically, the lower 64 bits of
the IPv6 address contains a hash over a public key. This makes it
possible to prove ownership over an address.
The not free part is that you need to configure certificates for trust
relationships = the routers that may be default gateways.
More information about the NANOG
mailing list