Re: v6 subnet size for DSL & leased line customers

[Iljitsch van Beijnum]

On 26 dec 2007, at 19:22, Tony Li wrote:

> This doesn't resolve the real underlying problem: Ethernet is  
> inherently insecure.  MAC addresses can be forged, protocols (ARP,  
> ND) can be forged and at this point, there's not much that we can do  
> about it.  Architecturally, we need authentication over each and  
> every control plane packet sent.  Getting there without invoking the  
> full complexity of a public key infrastructure is still an unsolved  
> problem, AFAIK.

Actually, for this particular purpose, this is mostly a solved  
problem, although there is of course no free lunch.

Many switches can enforce a MAC/port relationship, so that MAC  
addresses can't be spoofed.

Neighbor discovery and router advertisements can be secured with SEND  
(SEcure Neighbor Discovery). This happens through CGAs,  
cryptograpically generated addresses. Basically, the lower 64 bits of  
the IPv6 address contains a hash over a public key. This makes it  
possible to prove ownership over an address.

The not free part is that you need to configure certificates for trust  
relationships = the routers that may be default gateways.