Re: Advantages and disadvantages of using CB64 type of identifiers

El 02/07/2004, a las 0:08, Erik Nordmark escribió:

>> - source locator rewriting by edge routers is precluded
>> - changes in the prefix implies changes in the identifiers
>>    - so when the mh site changes isps it will need
>>      to renumber both its locators and its identifiers
>
> Hmm - this assumes that the IID is different for each prefix.
>

or for the set of prefixes that are configured in the mh site. But 
bottom line is that when a prefix is added or removed, iids have to 
change.

> My understanding is that SeND chose different IIDs for different 
> prefixes
> but that might be overkill.

that would be great news

>  If the IID is not a function of the prefix
> it would enable redirection by a resourceful attacker
> by precomputing 2^64 public/private keys that hash to all 2^64 IIDs.
> If the content of the packets are encrypted the redirection would not
> provide access to the content; it could only be used for DoS or for
> gathering the content for cryptoanalysis.
>

i don't quite follow this...

i mean, if the iid is used by apps to provide some form of 
authentication/authorization, having a public key that matches with the 
iid may enable to impersonate the real owner of the iid, right?
and since the iids are crypto, one may assume that apps may want to use 
to authentication, i guess.
But this may depend on the details, i guess.

regards, marcelo

> A while back Jari Arkko computed the amount of space needed to store
> 2^64 precomputed keys, and the storage space was a few buildings the 
> size
> of the former world trade center buildings I think.
>
> An organization which is willing to spend that much resources today on
> redirecting packets can probably do it more efficiently by gaining 
> access
> to links within or between large ISPs.
>
> So the question is whether we believe that the cost of the 
> precomputation
> and storage would drop so much over 20 years that this would become one
> of the more attractive ways to DoS or gather data for cryptoanalysis.
>
>    Erik
>