draft-ietf-lisp-threats-07.txt   draft-ietf-lisp-threats-08.txt 
Network Working Group D. Saucez Network Working Group D. Saucez
Internet-Draft INRIA Internet-Draft INRIA
Intended status: Informational L. Iannone Intended status: Informational L. Iannone
Expires: April 10, 2014 Telecom ParisTech Expires: April 24, 2014 Telecom ParisTech
O. Bonaventure O. Bonaventure
Universite catholique de Louvain Universite catholique de Louvain
October 07, 2013 October 21, 2013
LISP Threats Analysis LISP Threats Analysis
draft-ietf-lisp-threats-07.txt draft-ietf-lisp-threats-08.txt
Abstract Abstract
This document proposes a threat analysis of the Locator/Identifier This document proposes a threat analysis of the Locator/Identifier
Separation Protocol (LISP) if deployed in the Internet. Separation Protocol (LISP) if deployed in the Internet.
Status of This Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
skipping to change at page 1, line 34 skipping to change at page 1, line 34
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on April 10, 2014. This Internet-Draft will expire on April 24, 2014.
Copyright Notice Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. On-path Attackers . . . . . . . . . . . . . . . . . . . . . . 3 2. On-path Attackers . . . . . . . . . . . . . . . . . . . . . . 3
3. Off-Path Attackers: Reference Environment . . . . . . . . . . 3 3. Off-Path Attackers: Reference Environment . . . . . . . . . . 4
4. Attack vectors . . . . . . . . . . . . . . . . . . . . . . . 5 4. Attack vectors . . . . . . . . . . . . . . . . . . . . . . . 5
4.1. Configured EID-to-RLOC mappings . . . . . . . . . . . . . 5 4.1. Configured EID-to-RLOC mappings . . . . . . . . . . . . . 5
4.2. EID-to-RLOC Cache . . . . . . . . . . . . . . . . . . . . 6 4.2. EID-to-RLOC Cache . . . . . . . . . . . . . . . . . . . . 6
4.3. Attacks using the data-plane . . . . . . . . . . . . . . 6 4.3. Attacks using the data-plane . . . . . . . . . . . . . . 6
4.3.1. Attacks not leveraging on the LISP header . . . . . . 7 4.3.1. Attacks not leveraging on the LISP header . . . . . . 6
4.3.2. Attacks leveraging on the LISP header . . . . . . . . 8 4.3.2. Attacks leveraging on the LISP header . . . . . . . . 8
4.4. Attacks using the control-plane . . . . . . . . . . . . . 10 4.4. Attacks using the control-plane . . . . . . . . . . . . . 11
4.4.1. Attacks with Map-Request messages . . . . . . . . . . 11 4.4.1. Attacks with Map-Request messages . . . . . . . . . . 11
4.4.2. Attacks with Map-Reply messages . . . . . . . . . . . 12 4.4.2. Attacks with Map-Reply messages . . . . . . . . . . . 12
4.4.3. Attacks with Map-Register messages . . . . . . . . . 13 4.4.3. Attacks with Map-Register messages . . . . . . . . . 13
4.4.4. Attacks with Map-Notify messages . . . . . . . . . . 14 4.4.4. Attacks with Map-Notify messages . . . . . . . . . . 14
5. Attack categories . . . . . . . . . . . . . . . . . . . . . . 14 5. Attack categories . . . . . . . . . . . . . . . . . . . . . . 14
5.1. Intrusion . . . . . . . . . . . . . . . . . . . . . . . . 14 5.1. Intrusion . . . . . . . . . . . . . . . . . . . . . . . . 14
5.1.1. Description . . . . . . . . . . . . . . . . . . . . . 14 5.1.1. Description . . . . . . . . . . . . . . . . . . . . . 14
5.1.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 14 5.1.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 14
5.2. Denial of Service (DoS) . . . . . . . . . . . . . . . . . 14 5.2. Denial of Service (DoS) . . . . . . . . . . . . . . . . . 14
5.2.1. Description . . . . . . . . . . . . . . . . . . . . . 14 5.2.1. Description . . . . . . . . . . . . . . . . . . . . . 14
5.2.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 14 5.2.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 15
5.3. Subversion . . . . . . . . . . . . . . . . . . . . . . . 15 5.3. Subversion . . . . . . . . . . . . . . . . . . . . . . . 15
5.3.1. Description . . . . . . . . . . . . . . . . . . . . . 15 5.3.1. Description . . . . . . . . . . . . . . . . . . . . . 15
5.3.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 15 5.3.2. Vectors . . . . . . . . . . . . . . . . . . . . . . . 15
6. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15 6. Note on privacy . . . . . . . . . . . . . . . . . . . . . . . 16
7. Security Considerations . . . . . . . . . . . . . . . . . . . 16 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 16
8. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 16 8. Security Considerations . . . . . . . . . . . . . . . . . . . 16
9. References . . . . . . . . . . . . . . . . . . . . . . . . . 16 9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 17
9.1. Normative References . . . . . . . . . . . . . . . . . . 16 10. References . . . . . . . . . . . . . . . . . . . . . . . . . 17
9.2. Informative References . . . . . . . . . . . . . . . . . 17 10.1. Normative References . . . . . . . . . . . . . . . . . . 17
Appendix A. Document Change Log . . . . . . . . . . . . . . . . 18 10.2. Informative References . . . . . . . . . . . . . . . . . 18
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 20 Appendix A. Document Change Log . . . . . . . . . . . . . . . . 19
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 21
1. Introduction 1. Introduction
The Locator/ID Separation Protocol (LISP) is defined in [RFC6830]. The Locator/ID Separation Protocol (LISP) is defined in [RFC6830].
The present document assesses the security level and identifies The present document assesses the security level and identifies
security threats in the LISP specification if LISP is deployed in the security threats in the LISP specification if LISP is deployed in the
Internet (i.e., a public non-trustable environment). As a result of Internet (i.e., a public non-trustable environment). As a result of
the performed analysis, the document discusses the severity of the the performed analysis, the document discusses the severity of the
threats and proposes recommendations to reach the same level of threats and proposes recommendations to reach the same level of
security in LISP than in Internet today (e.g., without LISP). security in LISP than in Internet today (e.g., without LISP).
skipping to change at page 3, line 37 skipping to change at page 3, line 34
and does not discuss the difference, from a security viewpoint, and does not discuss the difference, from a security viewpoint,
between using IPv4 or IPv6. between using IPv4 or IPv6.
2. On-path Attackers 2. On-path Attackers
On-path attackers are attackers that are able to capture and modify On-path attackers are attackers that are able to capture and modify
all the packets exchanged between an Ingress Tunnel Router (ITR) and all the packets exchanged between an Ingress Tunnel Router (ITR) and
an Egress Tunnel Router (ETR). To cope with such an attacker, an Egress Tunnel Router (ETR). To cope with such an attacker,
cryptographic techniques such as those used by IPSec ([RFC4301]) are cryptographic techniques such as those used by IPSec ([RFC4301]) are
required. As with IP, LISP relies on higher layer cryptography to required. As with IP, LISP relies on higher layer cryptography to
secure packet payloads from on path attacks, so we do not consider secure packet payloads from on path attacks, so this document does
on-path attackers in this document. not consider on-path attackers in this document.
Similarly, a time-shifted attack is an attack where the attacker is Similarly, a time-shifted attack is an attack where the attacker is
temporarily on the path between two communicating hosts. While it is temporarily on the path between two communicating hosts. While it is
on-path, the attacker sends specially crafted packets or modifies on-path, the attacker sends specially crafted packets or modifies
packets exchanged by the communicating hosts in order to disturb the packets exchanged by the communicating hosts in order to disturb the
packet flow (e.g., by performing a man in the middle attack). An packet flow (e.g., by performing a man in the middle attack). An
important issue for time-shifted attacks is the duration of the important issue for time-shifted attacks is the duration of the
attack once the attacker has left the path between the two attack once the attacker has left the path between the two
communicating hosts. We do not consider time-shifted attacks in this communicating hosts. We do not consider time-shifted attacks in this
document. document.
3. Off-Path Attackers: Reference Environment 3. Off-Path Attackers: Reference Environment
Throughout this document we consider the reference environment shown
in the figure below. There are two hosts attached to LISP routers: The reference environment shown in the figure below is considered
HA and HB. HA is attached to the two LISP xTRs LR1 and LR2, which in throughout this document. There are two hosts attached to LISP
turn are attached to two different ISPs. HB is attached to the two routers: HA and HB. HA is attached to the two LISP xTRs LR1 and LR2,
LISP xTRs LR3 and LR4. HA and HB are the EIDs of the two hosts. which in turn are attached to two different ISPs. HB is attached to
LR1, LR2, LR3, and LR4 are the RLOCs of the xTRs. PxTR is a proxy the two LISP xTRs LR3 and LR4. HA and HB are the EIDs of the two
xTR and MR/MS plays the roles of Map Server and/or Map Resolver. hosts. LR1, LR2, LR3, and LR4 are the RLOCs of the xTRs. PxTR is a
proxy xTR and MR/MS plays the roles of Map Server and/or Map
Resolver.
+-----+ +-----+
| HA | | HA |
+-----+ +-----+
| EID: HA | EID: HA
| |
----------------- -----------------
| | | |
+-----+ +-----+ +-----+ +-----+
| LR1 | | LR2 | | LR1 | | LR2 |
skipping to change at page 6, line 20 skipping to change at page 6, line 22
4.2. EID-to-RLOC Cache 4.2. EID-to-RLOC Cache
The EID-to-RLOC Cache (also called the Map-Cache) is the data The EID-to-RLOC Cache (also called the Map-Cache) is the data
structure that stores a copy of the mappings retrieved from a remote structure that stores a copy of the mappings retrieved from a remote
ETR's mapping via the LISP control-plane. Attacks against this data ETR's mapping via the LISP control-plane. Attacks against this data
structure could happen either when the mappings are first installed structure could happen either when the mappings are first installed
in the cache or by corrupting (poisoning) the mappings already in the cache or by corrupting (poisoning) the mappings already
present in the cache. present in the cache.
In this document we call "cache poisoning attack", any attack that This document calls "cache poisoning attack", any attack that alters
alters the EID-to-RLOC Cache. Cache poisoning attacks are use to the EID-to-RLOC Cache. Cache poisoning attacks are use to alter (any
alter (any combination of) the following parts of mapping installed combination of) the following parts of mapping installed in the EID-
in the EID-to-RLOC Cache: to-RLOC Cache:
o EID prefix o EID prefix
o RLOC list o RLOC list
o RLOC priority o RLOC priority
o RLOC weight o RLOC weight
o RLOC reachability o RLOC reachability
skipping to change at page 15, line 41 skipping to change at page 16, line 4
requirement to carry out and eavesdropping attack. Indeed the requirement to carry out and eavesdropping attack. Indeed the
attacker might be able, for instance through an intrusion attack on a attacker might be able, for instance through an intrusion attack on a
weaker system, either to duplicate or even re-direct the traffic, in weaker system, either to duplicate or even re-direct the traffic, in
both cases having access to the raw packets. both cases having access to the raw packets.
5.3.2. Vectors 5.3.2. Vectors
Subversion attacks can be mounted using Subversion attacks can be mounted using
o Gleaning o Gleaning
o Locator Status Bits o Locator Status Bits
o Nonce-Present and the Echo-Nonce bits o Nonce-Present and the Echo-Nonce bits
o Map-Request messages o Map-Request messages
o Map-Reply messages o Map-Reply messages
6. IANA Considerations 6. Note on privacy
As presented by [RFC6973], universal privacy considerations are
impossible to establish as the privacy definition may vary from one
to another. As a consequence, this document does not aim at
identifying privacy issues related to the LISP protocol but it is
necessary to highlight that security threats identified in this
document could play a role in privacy threats as defined in section 5
of [RFC6973].
7. IANA Considerations
This document makes no request to IANA. This document makes no request to IANA.
7. Security Considerations 8. Security Considerations
This document is devoted to threat analysis of the Locator/Identifier This document is devoted to threat analysis of the Locator/Identifier
Separation Protocol and is then a piece of choice to understand the Separation Protocol and is then a piece of choice to understand the
security risks at stake while deploying LISP in non-trustable security risks at stake while deploying LISP in non-trustable
environment. environment.
The purpose of this document is not to provide recommendations to The purpose of this document is not to provide recommendations to
protect against attacks, however most of threats can be prevented protect against attacks, however most of threats can be prevented
with careful deployment and configuration (e.g., filter) and also by with careful deployment and configuration (e.g., filter) and also by
applying the general rules in security that consist in activating applying the general rules in security that consist in activating
only features that are necessary in the deployment and verifying the only features that are necessary in the deployment and verifying the
validity of the information obtained from third parties. More validity of the information obtained from third parties. More
detailed recommendation are given in [book_chapter]. detailed recommendation are given in [book_chapter].
The control-plane is probably the most critical part of LISP from a The control-plane is probably the most critical part of LISP from a
security viewpoint and it is worth to notice that the specifications security viewpoint and it is worth to notice that the specifications
already offer authentication mechanism for Map-Register messages already offer authentication mechanism for Map-Register messages
([RFC6833]) and that [I-D.ietf-lisp-sec] and [I-D.ietf-lisp-ddt] are ([RFC6833]) and that [I-D.ietf-lisp-sec] and [I-D.ietf-lisp-ddt] are
clearly going in the direction of a secure control-plane. clearly going in the direction of a secure control-plane.
8. Acknowledgments 9. Acknowledgments
This document builds upon the draft of Marcelo Bagnulo This document builds upon the draft of Marcelo Bagnulo
([I-D.bagnulo-lisp-threat]), where the flooding attack and the ([I-D.bagnulo-lisp-threat]), where the flooding attack and the
reference environment were first described. reference environment were first described.
The authors would like to thank Ronald Bonica, Albert Cabellos, Noel The authors would like to thank Ronald Bonica, Albert Cabellos, Noel
Chiappa, Florin Coras, Vina Ermagan, Dino Farinacci, Joel Halpern, Chiappa, Florin Coras, Vina Ermagan, Dino Farinacci, Stephen Farrell,
Emily Hiltzik, Darrel Lewis, Edward Lopez, Fabio Maino, Terry Joel Halpern, Emily Hiltzik, Darrel Lewis, Edward Lopez, Fabio Maino,
Manderson, and Jeff Wheeler for their comments. Terry Manderson, and Jeff Wheeler for their comments.
This work has been partially supported by the INFSO-ICT-216372 This work has been partially supported by the INFSO-ICT-216372
TRILOGY Project (www.trilogy-project.org). TRILOGY Project (www.trilogy-project.org).
9. References 10. References
9.1. Normative References 10.1. Normative References
[RFC6169] Krishnan, S., Thaler, D., and J. Hoagland, "Security [RFC6169] Krishnan, S., Thaler, D., and J. Hoagland, "Security
Concerns with IP Tunneling", RFC 6169, April 2011. Concerns with IP Tunneling", RFC 6169, April 2011.
[RFC6830] Farinacci, D., Fuller, V., Meyer, D., and D. Lewis, "The [RFC6830] Farinacci, D., Fuller, V., Meyer, D., and D. Lewis, "The
Locator/ID Separation Protocol (LISP)", RFC 6830, January Locator/ID Separation Protocol (LISP)", RFC 6830, January
2013. 2013.
[RFC6832] Lewis, D., Meyer, D., Farinacci, D., and V. Fuller, [RFC6832] Lewis, D., Meyer, D., Farinacci, D., and V. Fuller,
"Interworking between Locator/ID Separation Protocol "Interworking between Locator/ID Separation Protocol
skipping to change at page 17, line 24 skipping to change at page 17, line 49
Separation Protocol (LISP) Map-Versioning", RFC 6834, Separation Protocol (LISP) Map-Versioning", RFC 6834,
January 2013. January 2013.
[RFC6836] Fuller, V., Farinacci, D., Meyer, D., and D. Lewis, [RFC6836] Fuller, V., Farinacci, D., Meyer, D., and D. Lewis,
"Locator/ID Separation Protocol Alternative Logical "Locator/ID Separation Protocol Alternative Logical
Topology (LISP+ALT)", RFC 6836, January 2013. Topology (LISP+ALT)", RFC 6836, January 2013.
[RFC6837] Lear, E., "NERD: A Not-so-novel Endpoint ID (EID) to [RFC6837] Lear, E., "NERD: A Not-so-novel Endpoint ID (EID) to
Routing Locator (RLOC) Database", RFC 6837, January 2013. Routing Locator (RLOC) Database", RFC 6837, January 2013.
9.2. Informative References [RFC6973] Cooper, A., Tschofenig, H., Aboba, B., Peterson, J.,
Morris, J., Hansen, M., and R. Smith, "Privacy
Considerations for Internet Protocols", RFC 6973, July
2013.
10.2. Informative References
[Chu] Jerry Chu, H., "Tuning TCP Parameters for the 21st Century [Chu] Jerry Chu, H., "Tuning TCP Parameters for the 21st Century
", 75th IETF, Stockholm, July 2009, ", 75th IETF, Stockholm, July 2009,
<http://tools.ietf.org/wg/savi/>. <http://tools.ietf.org/wg/savi/>.
[I-D.bagnulo-lisp-threat] [I-D.bagnulo-lisp-threat]
Bagnulo, M., "Preliminary LISP Threat Analysis", draft- Bagnulo, M., "Preliminary LISP Threat Analysis", draft-
bagnulo-lisp-threat-01 (work in progress), July 2007. bagnulo-lisp-threat-01 (work in progress), July 2007.
[I-D.ietf-lisp-ddt] [I-D.ietf-lisp-ddt]
skipping to change at page 18, line 42 skipping to change at page 19, line 21
Future Internet, 2009. Future Internet, 2009.
[book_chapter] [book_chapter]
Saucez, D., Iannone, L., and O. Bonaventure, "The Map-and- Saucez, D., Iannone, L., and O. Bonaventure, "The Map-and-
Encap Locator/Identifier separation paradigm: a Security Encap Locator/Identifier separation paradigm: a Security
Analysis ", Solutions for Sustaining Scalability in Analysis ", Solutions for Sustaining Scalability in
Internet Growth, IGI Global, 2013. Internet Growth, IGI Global, 2013.
Appendix A. Document Change Log Appendix A. Document Change Log
o Version 08 Posted October 2013.
* Addition of a privacy consideration note.
* Editorial changes
o Version 07 Posted October 2013. o Version 07 Posted October 2013.
* This version is updated according to the thorough review made * This version is updated according to the thorough review made
during October 2013 LISP WG interim meeting. during October 2013 LISP WG interim meeting.
* Brief recommendations put in the security consideration * Brief recommendations put in the security consideration
section. section.
* Editorial changes * Editorial changes
 End of changes. 21 change blocks. 
39 lines changed or deleted 63 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/