Subject: zeroconf protocol security

From: Erik Guttman <[email-masked]>
Date: Fri, 7 Jan 2000 12:52:36 +0100 (MET)

We have a fundamental question to answer.  Do we want to assume that
ZeroConf protocols will operate insecurely and leave security to their
'big brother' protocols?  Or do we want to require that one *could*
configure the ZeroConf protocols with security to allow them to be
used (to some extent) securely.

For example:

IP host configuration will use a claim and defend protocol similar
to (if not exactly) the protocol specified by 

This has no security provision.  We could require that it could
carry security information.  In this case we could not use ARP,
since ARP is insecure.  To illustrate - 

  . Each host must be able to be configured with a secret key, S.
  . Probably a NONCE would have to be added to the message.
  . Each claim is made with Keyed MD5 HMAC, using S.  The 16 byte
    hash is included in the message.

Hosts would simply ignore messages sent without the proper accompanying
hash.  Benefits:

  + A population of hosts which have been configured with the secret
    key S would be able to resist a hoarding attack (where a host
    claims to already own all IP addresses).

Disadvantages:

  - This complicates the claim and defend protocol.
  - ARP would not be able to be used.
  - The protection would not be very great - other hosts could still
    use the IP addresses claimed by those who possess secret key S.

Similar trade offs and discussion could be presented for multicast
name to address resolution, name claim and defend (as mentioned in 
section 3.2.1.2 of draft-ietf-zeroconf-reqts-01.txt) and multicast
address allocation.

What do you think?

Erik

---

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 14 Jan 2000 07:41:44 -0800

My take on this is that zeroconf networks should not create
or require security mechanisms above and beyond those 
already available in non-zeroconf environments. If
simpler security mechanisms are needed then they should
be created to apply to both zeroconf and non-zeroconf
networks. For example, creating a secure ARP alternative 
just for zeroconf seems inappropriate. Either this is
generally useful (I doubt it) or not.

---

From: Erik Guttman <[email-masked]>
Date: Fri, 14 Jan 2000 17:15:55 +0100 (MET)

I assume this is in response to my posting to the list on Wednesday:

> 4.2.1  IP Host Configuration
>
>    Hosts MUST be able to be configured to use DHCP authentication.
>
>    Option 1:
>
>       No provision is made for securing IP Host Configuration using
>       the ZeroConf protocol for IP Host Configuration.
>
>    Option 2:
>
>       Hosts MUST be able to be configured to use a ZeroConf protocol
>       for host configuration securely.  For example, a claim and defend
>       protocol used for host configuration would have to include security 
>       data with all messages.  A host in the ZeroConf network could verify
>       that another host's claim was legitimate or not. 

You are essentially saying you support Option 1.  I personally agree with 
you.  I included this text to get people discussing this topic.

Thanks for getting the ball rolling :^)

Erik