Does the kernel IPv6 module plan to implement Secure Neighbor Discovery?

Does the kernel IPv6 module plan to implement Secure Neighbor Discovery?

[Ttttabcd]

IPv6 is rapidly deploying globally. NDP replaces the role of ARP in IPv6 and provides mapping from IP address to MAC address.

However, the NDP protocol is as insecure as the ARP protocol, and can be easily spoofed, and then the attacker can conduct man-in-the-middle attacks.

The solution to the weak security problem is to use Secure Neighbor Discovery, Abbreviation, SeND.

SeND uses Cryptographically Generated Addresses and public keys to authenticate information provided by NDP messages.

I think SeND is a very important security facility under IPv6. I found some implementations in user space, but not in the kernel.

I searched the mail records in lkml.org and found that no one was discussing SeND.

So I am confused, is the kernel planning to implement SeND? Or should SeND be implemented in user space?

Re: Does the kernel IPv6 module plan to implement Secure Neighbor Discovery?

[Eric W. Biederman]

Ttttabcd <ttttabcd@protonmail.com> writes:

> IPv6 is rapidly deploying globally. NDP replaces the role of ARP in IPv6 and provides mapping from IP address to MAC address.
>
> However, the NDP protocol is as insecure as the ARP protocol, and can be easily spoofed, and then the attacker can conduct man-in-the-middle attacks.
>
> The solution to the weak security problem is to use Secure Neighbor Discovery, Abbreviation, SeND.
>
> SeND uses Cryptographically Generated Addresses and public keys to authenticate information provided by NDP messages.
>
> I think SeND is a very important security facility under IPv6. I found some implementations in user space, but not in the kernel.
>
> I searched the mail records in lkml.org and found that no one was discussing SeND.
>
> So I am confused, is the kernel planning to implement SeND? Or should SeND be implemented in user space?

Usually it requires someone motivated to step up and do the work.  You
sound motivated.  The easiest thing would be for you to step up and
write the implementation.

Having looked at this once long ago my memory is that SeND only protects
against an attacker on a local lan.  That is not an attack scenario I am
particularly worried about.  If my memory is correct there are
additional issues with how you perform the initial key distribution.
All of which is why I am personally not interested.

But if you are interested and would like to make this happen more power
to you.

Eric

Re: Does the kernel IPv6 module plan to implement Secure Neighbor Discovery?

[Ttttabcd]

>
> Usually it requires someone motivated to step up and do the work. You
> sound motivated. The easiest thing would be for you to step up and
> write the implementation.
>
> Having looked at this once long ago my memory is that SeND only protects
> against an attacker on a local lan. That is not an attack scenario I am
> particularly worried about. If my memory is correct there are
> additional issues with how you perform the initial key distribution.
> All of which is why I am personally not interested.
>
> But if you are interested and would like to make this happen more power
> to you.
>
> Eric

I also thought about implementing it myself, but I am still a kernel beginner.

I am learning the source implementation of the network protocol stack, but I think there is still a long way to go to implement a complete function.

I will work hard, I hope to contribute to the kernel, thank you