Subject: Thoughts on security for zeroconf

From: Brad Hards <[email-masked]>
Date: Fri, 31 May 2002 10:28:51 +1000

Just some idle thoughts - not for inclusion in the drafts, but perhaps for 
discussion or at least personal thought.

If you consider that there may be malicious hosts on your link local network, 
then there is no system that can avoid DoS.

Examples.
Static IP: Malicious host assigns address that is the same as another 
statically assigned IP.
OR
Malicious host just floods network.

Dynamic IP: Malicious host just cycles through a range of hw addresses, 
claiming all available IPs from DHCP server.
OR
Malicious host just floods network.

Zeroconf: Malicious host answers all ARP probes, denying new users an IP.
OR
Malicious host just floods network.

In some ways the zeroconf case is better, because you can recover it more 
easily (you only need to find the malicious host, where DHCP requires finding 
the malicious host, rebooting the DHCP server, and reconfiguring all users).

If you trust your local link (eg, it is a usb to usb networking cable that 
looks like virtual ethernet, and you can see both ends, and you can thump the 
guy on the other end if necessary), then you don't need to secure the _link_. 

If you don't trust your local link (for some value of trust that is 
commensurate with the consequences of it failing), then you open yourself up 
to a denial of service attack of many kinds. It doesn't matter how you assign 
the IP address, you'll still be toast.

And it won't help to put a lot of detail in any particular RFC. If 
implementers don't really understand security, they are doomed to be 
frequently listed on bugtraq, no matter how much guidance is provided.

Thanks for your time.

Brad

-- 
http://conf.linux.org.au. 22-25Jan2003. Perth, Australia. Birds in Black.