On 26 dec 2007, at 19:22, Tony Li wrote:
This doesn't resolve the real underlying problem: Ethernet is inherently insecure. MAC addresses can be forged, protocols (ARP, ND) can be forged and at this point, there's not much that we can do about it. Architecturally, we need authentication over each and every control plane packet sent. Getting there without invoking the full complexity of a public key infrastructure is still an unsolved problem, AFAIK.
Actually, for this particular purpose, this is mostly a solved problem, although there is of course no free lunch.
Many switches can enforce a MAC/port relationship, so that MAC addresses can't be spoofed.
Neighbor discovery and router advertisements can be secured with SEND (SEcure Neighbor Discovery). This happens through CGAs, cryptograpically generated addresses. Basically, the lower 64 bits of the IPv6 address contains a hash over a public key. This makes it possible to prove ownership over an address.
The not free part is that you need to configure certificates for trust relationships = the routers that may be default gateways.
