Network Working Group                                          D. Saucez
Internet-Draft                                                     INRIA
Intended status: Informational                                L. Iannone
Expires: April 05, 2014                                Telecom ParisTech
                                                          O. Bonaventure
                                        Universite catholique de Louvain
                                                        October 02, 2013


                         LISP Threats Analysis
                     draft-ietf-lisp-threats-06.txt

Abstract

   This document discusses potential security concerns with the Locator/
   Identifier Separation Protocol (LISP) if deployed in the Internet and
   proposes a set of recommendations to mitigate the identified threats
   and to reach a level of security equivalent to what is observed in
   the Internet today (i.e., without LISP).  By following the
   recommendations of this draft a LISP deployment can achieve a
   security level that is comparable to the existing Internet
   architecture.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on April 05, 2014.

Copyright Notice

   Copyright (c) 2013 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of



Saucez, et al.           Expires April 05, 2014                 [Page 1]


Internet-Draft                LISP Threats                  October 2013


   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must
   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Definition of Terms . . . . . . . . . . . . . . . . . . . . .   3
   3.  On-path Attackers . . . . . . . . . . . . . . . . . . . . . .   4
   4.  Off-Path Attackers: Reference Environment . . . . . . . . . .   4
   5.  Attack vectors  . . . . . . . . . . . . . . . . . . . . . . .   6
     5.1.  EID-to-RLOC Database  . . . . . . . . . . . . . . . . . .   6
     5.2.  EID-to-RLOC Cache . . . . . . . . . . . . . . . . . . . .   6
     5.3.  Attack using the data-plane . . . . . . . . . . . . . . .   7
       5.3.1.  Attacks not leveraging on the LISP header . . . . . .   7
       5.3.2.  Attacks leveraging on the LISP header . . . . . . . .   9
     5.4.  Attack using the control-plane  . . . . . . . . . . . . .  11
       5.4.1.  Attacks with Map-Request messages . . . . . . . . . .  11
       5.4.2.  Attacks with Map-Reply messages . . . . . . . . . . .  13
       5.4.3.  Attacks with Map-Register messages  . . . . . . . . .  14
       5.4.4.  Attacks with Map-Notify messages  . . . . . . . . . .  14
   6.  Attack categories . . . . . . . . . . . . . . . . . . . . . .  14
     6.1.  Intrusion . . . . . . . . . . . . . . . . . . . . . . . .  14
       6.1.1.  Description . . . . . . . . . . . . . . . . . . . . .  14
       6.1.2.  Vectors . . . . . . . . . . . . . . . . . . . . . . .  14
     6.2.  Denial of Service (DoS) . . . . . . . . . . . . . . . . .  15
       6.2.1.  Description . . . . . . . . . . . . . . . . . . . . .  15
       6.2.2.  Vectors . . . . . . . . . . . . . . . . . . . . . . .  15
     6.3.  Eavesdropping . . . . . . . . . . . . . . . . . . . . . .  15
       6.3.1.  Description . . . . . . . . . . . . . . . . . . . . .  15
       6.3.2.  Vectors . . . . . . . . . . . . . . . . . . . . . . .  16
   7.  Recommendations . . . . . . . . . . . . . . . . . . . . . . .  16
   8.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .  16
   9.  Security Considerations . . . . . . . . . . . . . . . . . . .  16
   10. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . .  16
   11. References  . . . . . . . . . . . . . . . . . . . . . . . . .  16
     11.1.  Normative References . . . . . . . . . . . . . . . . . .  16
     11.2.  Informative References . . . . . . . . . . . . . . . . .  17
   Appendix A.  Document Change Log  . . . . . . . . . . . . . . . .  18
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .  20

1.  Introduction

   The Locator/ID Separation Protocol (LISP) is defined in [RFC6830].
   The present document assesses the security level and identifies



Saucez, et al.           Expires April 05, 2014                 [Page 2]


Internet-Draft                LISP Threats                  October 2013


   security threats in the LISP specification if LISP is deployed in the
   Internet (i.e., a public non-trustable environment).  As a result of
   the performed analysis, the document discusses the severity of the
   threats and proposes recommendations to reach the same level of
   security in LISP than in Internet today (e.g., without LISP).

   The document is composed of three main parts: the first discussing
   the LISP data-plane; while the second discussing the LISP control-
   plane.  The final part summarizes the recommendations to prevent the
   identified threats.

   The LISP data-plane consists of LISP packet encapsulation,
   decapsulation, and forwarding and includes the EID-to-RLOC Cache and
   EID-to-RLOC Database data structures used to perform these
   operations.

   The LISP control-plane consists in the mapping distribution system,
   which can be one of the mapping distribution systems proposed so far
   (e.g., [RFC6830], [I-D.ietf-lisp-ddt], [RFC6836], [RFC6833],
   [I-D.meyer-lisp-cons], and [RFC6837]), and the Map-Request, Map-
   Reply, Map-Register, and Map-Notification messages.

   This document does not consider all the possible uses of LISP as
   discussed in [RFC6830].  The document focuses on LISP unicast,
   including as well LISP Interworking [RFC6832], LISP-MS [RFC6833],
   LISP Map-Versioning [RFC6834], and briefly considering the ALT
   mapping system described in [RFC6836] and the Delegated Database Tree
   mapping system described in [I-D.ietf-lisp-ddt].  The reading of
   these documents is a prerequisite for understanding the present
   document.

   Unless otherwise stated, the document assumes a generic IP service
   and does not discuss the difference, from a security viewpoint,
   between using IPv4 or IPv6.

   This document has identified several threats on LISP in the case of
   public deployments.  However, most of the threats can be prevented
   with careful deployment and configuration and general rules in
   security that consist in activating only features that are necessary
   in the deployment and to carefully verifying the validity of the
   information obtained from third parties also applies in the case of
   LISP.  Finally, this document has not identified any threats that
   would require a change in the LISP protocol or architecture.

2.  Definition of Terms






Saucez, et al.           Expires April 05, 2014                 [Page 3]


Internet-Draft                LISP Threats                  October 2013


   The present document does not introduce any other new term, compared
   to the main LISP specification.  For a complete list of terms please
   refer to [RFC6830].

3.  On-path Attackers

   On-path attackers are attackers that are able to capture and modify
   all the packets exchanged between an Ingress Tunnel Router (ITR) and
   an Egress Tunnel Router (ETR).  To cope with such an attacker,
   cryptographic techniques such as those used by IPSec ([RFC4301]) are
   required.  As with IP, LISP relies on higher layer cryptography to
   secure packet payloads from on path attacks, so we do not consider
   on-path attackers in this document.

   Similarly, a time-shifted attack is an attack where the attacker is
   temporarily on the path between two communicating hosts.  While it is
   on-path, the attacker sends specially crafted packets or modifies
   packets exchanged by the communicating hosts in order to disturb the
   packet flow (e.g., by performing a man in the middle attack).  An
   important issue for time-shifted attacks is the duration of the
   attack once the attacker has left the path between the two
   communicating hosts.  We do not consider time-shifted attacks in this
   document.

4.  Off-Path Attackers: Reference Environment

   Throughout this document we consider the reference environment shown
   in the figure below.  There are two hosts attached to LISP routers:
   HA and HB.  HA is attached to the two LISP xTRs LR1 and LR2, which in
   turn are attached to two different ISPs.  HB is attached to the two
   LISP xTRs LR3 and LR4.  HA and HB are the EIDs of the two hosts.
   LR1, LR2, LR3, and LR4 are the RLOCs of the xTRs.  PxTR is a proxy
   xTR and MR/MS plays the roles of Map Server and/or Map Resolver.

                +-----+
                | HA  |
                +-----+
                   | EID: HA
                   |
               -----------------
                   |          |
                +-----+    +-----+
                | LR1 |    | LR2 |
                +-----+    +-----+
                   |          |
                   |          |
                +-----+    +-----+
                |ISP1 |    |ISP2 |



Saucez, et al.           Expires April 05, 2014                 [Page 4]


Internet-Draft                LISP Threats                  October 2013


                +-----+    +-----+
                   |          |
   +------+     +----------------+     +-----+
   | PxTR |-----|                |-----| SA  |
   +------+     |                |     +-----+
                |    Internet    |
   +-------+    |                |     +-----+
   | MR/MS |----|                |-----| NSA |
   +-------+    +----------------+     +-----+
                   |          |
                +-----+    +-----+
                | LR3 |    | LR4 |
                +-----+    +-----+
                   |          |
               -------------------
                              |
                              | EID: HB
                           +-----+
                           | HB  |
                           +-----+

                        Figure 1: Reference Network

   We consider two off-path attackers with different capabilities:

   SA  is an off-path attacker that is able to send spoofed packets,
       i.e., packets with a different source IP address than its
       assigned IP address.  SA stands for Spoofing Attacker.

   NSA is an off-path attacker that is only able to send packets whose
       source address is its assigned IP address.  NSA stands for Non
       Spoofing Attacker.

   It should be noted that with LISP, packet spoofing is slightly
   different than in the current Internet.  Generally the term "spoofed
   packet" indicates a packet containing a source IP address that is not
   the one of the actual originator of the packet.  Since LISP uses
   encapsulation, the spoofed address could be in the outer header as
   well as in the inner header, this translates in two types of
   spoofing:

   EID Spoofing:  the originator of the packet puts in it a spoofed EID.
         The packet will be normally encapsulated by the ITR of the site
         (or a PITR if the source site is not LISP enabled).

   RLOC Spoofing:  the originator of the packet generates directly a
         LISP-encapsulated packet with a spoofed source RLOC.




Saucez, et al.           Expires April 05, 2014                 [Page 5]


Internet-Draft                LISP Threats                  October 2013


   Note that the two types of spoofing are not mutually exclusive,
   rather all combinations are possible and could be used to perform
   different kind of attacks.

   In the reference environment, both SA and NSA attackers are capable
   of sending LISP encapsulated data packets and LISP control packets.
   This means that SA is able to perform both RLOC and EID spoofing
   while NSA can only perform EID spoofing.  They may also send other
   types of IP packets such as ICMP messages.  We assume that both
   attackers can query the LISP mapping system (e.g., through a public
   Map Resolver) to obtain the mappings for both HA and HB.

5.  Attack vectors

   This section presents techniques that can be used by attackers to
   succeed attacks leveraging the LISP protocol and architecture.  This
   section focuses on the techniques while Section 6 presents the
   attacks that can be succeeded while using these techniques.

5.1.  EID-to-RLOC Database

   The EID-to-RLOC Database on each xTR maintains the set of mappings
   related to the EID-Prefixes that are "behind" the xTR.  Where
   "behind" means that at least one of the xTR's globally visible IP
   addresses is a RLOC for those EID-Prefixes.

   As described in [RFC6830], the EID-to-RLOC Database content is
   determined by configuration.  This means that the only way to attack
   this data structure is by gaining privileged access to the xTR.  As
   such, it is out of the scope of LISP to propose any mechanism to
   protect routers and, hence, it is no further analyzed in this
   document.

5.2.  EID-to-RLOC Cache

   The EID-to-RLOC Cache (also called the Map-Cache) is the data
   structure that stores a copy of the mappings retrieved from a remote
   ETR's mapping database via the LISP control-plane.  Attacks against
   this data structure could happen either when the mappings are first
   installed in the cache or by corrupting (poisoning) the mappings
   already present in the cache.

   In this document we call "cache poisoning attack", any attach that
   alters the EID-to-RLOC Cache.  Cache poisoning attacks are use to
   alter (any combination of) the following parts of mapping installed
   in the EID-to-RLOC Cache:

   o  EID prefix



Saucez, et al.           Expires April 05, 2014                 [Page 6]


Internet-Draft                LISP Threats                  October 2013


   o  RLOC list

   o  RLOC priority

   o  RLOC weight

   o  RLOC reachability

   o  Mapping TTL

   o  Mapping version

   o  Mapping Instance ID

5.3.  Attack using the data-plane

   The data-plane is constituted of the operations of encapsulation,
   decapsulation, and forwarding as well as the content of the EID-to-
   RLOC Cache and EID-to-RLOC Database as specified in the original LISP
   document ([RFC6830]).

5.3.1.  Attacks not leveraging on the LISP header

   An attacker can inject packets into flows without using the LISP
   header, i.e., with the N, L, E, V, and I bits ([RFC6830]).

   To inject a packet in the HA-HB flow, a spoofing off-path attacker
   (SA) could send a LISP encapsulated packet whose source is set to LR1
   or LR2 and destination LR3 or LR4.  The packet will reach HB as if
   the packet was sent by host HA.  This is not different from today's
   Internet where a spoofing off-path attacker may inject data packets
   in any flow.  A non-spoofing off-path attacker (NSA) could only send
   a packet whose source address is set to its assigned IP address.  The
   destination address of the encapsulated packet could be LR3 or LR4.

5.3.1.1.  Gleaning Attacks

   In order to reduce the time required to obtain a mapping, [RFC6830]
   proposes the gleaning mechanism that allows an ITR to learn a mapping
   from the LISP data encapsulated packets and the Map-Request packets
   that it receives.  LISP data encapsulated packet contains a source
   RLOC, destination RLOC, source EID and destination EID.  When an ITR
   receives a data encapsulated packet coming from a source EID for
   which it does not already know a mapping, it may insert the mapping
   between the source RLOC and the source EID in its EID-to-RLOC Cache.
   Gleaning could also be used when an ITR receives a Map-Request as the
   Map-Request also contains a source EID address and a source RLOC.
   Once a gleaned entry has been added to the EID-to-RLOC cache, the



Saucez, et al.           Expires April 05, 2014                 [Page 7]


Internet-Draft                LISP Threats                  October 2013


   LISP ITR sends a Map-Request to retrieve the mapping for the gleaned
   EID from the mapping system.  [RFC6830] recommends storing the
   gleaned entries for only a few seconds.

   An attacker can send LISP encapsulated packets to host HB with host
   HA's EID and if the xTRs that serve host HB do not store a mapping
   for host HA at that time The xTR will store the gleaned entry and use
   it to return the packets sent by host HB.  In parallel, the ETR will
   send a Map-Request to retrieve the mapping for HA but until the
   reception of the Map-Reply, host HB will exchange packets with the
   attacker instead of HA.

   Similarly, if an off-path attacker knows that hosts HA and HB that
   resides in different sites will exchange information at time t the
   attacker could send to LR1 (resp. LR3) a LISP data encapsulated
   packet whose source RLOC is its IP address and contains an IP packet
   whose source is set to HB (resp. HA).  The attacker chooses a packet
   that will not trigger an answer, for example the last part of a
   fragmented packet.  Upon reception of these packets, LR1 and LR3
   install gleaned entries that point to the attacker.  If host HA is
   willing to establishes a flow with host HB at that time, the packets
   that they exchange will pass through the attacker as long as the
   gleaned entry is active on the xTRs.

   By itself, an attack made solely using gleaning cannot last long,
   however it should be noted that with current network capacities, a
   large amount of packets might be exchanged during even a small
   fraction of time.

5.3.1.2.  Threats concerning Interworking

   [RFC6832] defines Proxy-ITR And Proxy-ETR network elements to allow
   LISP and non-LISP sites to communicate.  The Proxy-ITR has
   functionality similar to the ITR, however, its main purpose is to
   encapsulate packets arriving from the DFZ in order to reach LISP
   sites.  A Proxy-ETR has functionality similar to the ETR, however,
   its main purpose is to inject de-encapsulated packets in the DFZ in
   order to reach non-LISP Sites from LISP sites.  As a PITR (resp.
   PETR) is a particular case of ITR (resp. ETR), it is subject to same
   attacks than ITRs (resp. ETR).

   PxTRs can be targeted by attacks aiming to influence traffic between
   LISP and non-LISP sites but also to launch relay attacks.

   It is worth to notice that when PITR and PETR functions are
   separated, attacks targeting xTRs are ineffective.





Saucez, et al.           Expires April 05, 2014                 [Page 8]


Internet-Draft                LISP Threats                  October 2013


5.3.2.  Attacks leveraging on the LISP header

   The main LISP document [RFC6830] defines several flags that modify
   the interpretation of the LISP header in data packets.  In this
   section, we discuss how an off-path attacker could exploit this LISP
   header.

5.3.2.1.  Attacks using the Locator Status Bits

   When the L bit is set to 1, it indicates that the second 32-bits
   longword of the LISP header contains the Locator Status Bits.  In
   this field, each bit position reflects the status of one of the RLOCs
   mapped to the source EID found in the encapsulated packet.  In
   particular, a packet with the L bit set and all Locator Status Bits
   set to zero indicates that none of the locators of the encapsulated
   source EID are reachable.  The reaction of a LISP ETR that receives
   such a packet is not clearly described in [RFC6830].

   An attacker can send a data packet with the L bit set to 1 and some
   or all Locator Status Bits set to zero.  Therefore, by blindly
   trusting the Locator Status Bits communication going on can be
   altered or forced to go through a particular set of locators.

5.3.2.2.  Attacks using the Map-Version bit

   The optional Map-Version bit is used to indicate whether the low-
   order 24 bits of the first 32 bits longword of the LISP header
   contain a Source and Destination Map-Version.  When a LISP ETR
   receives a LISP encapsulated packet with the Map-Version bit set to
   1, the following actions are taken:

   o  It compares the Destination Map-Version found in the header with
      the current version of its own mapping, in the EID-to-RLOC
      Database, for the destination EID found in the encapsulated
      packet.  If the received Destination Map-Version is smaller (i.e.,
      older) than the current version, the ETR should apply the SMR
      procedure described in [RFC6830] and send a Map-Request with the
      SMR bit set.

   o  If a mapping exists in the EID-to-RLOC Cache for the source EID,
      then it compares the Map-Version of that entry with the Source
      Map-Version found in the header of the packet.  If the stored
      mapping is older (i.e., the Map-Version is smaller) than the
      source version of the LISP encapsulated packet, the xTR should
      send a Map-Request for the source EID.

   An off-path attacker could use the Map-Version bit to force an ETR to
   send Map-Request messages.  The attacker could retrieve the current



Saucez, et al.           Expires April 05, 2014                 [Page 9]


Internet-Draft                LISP Threats                  October 2013


   source and destination Map-Version for both HA and HB.  Based on this
   information, it could send a spoofed packet with an older Source Map-
   Version or Destination Map-Version.  If the size of the Map-Request
   message is larger than the size of the smallest LISP-encapsulated
   packet that could trigger such a message, this could lead to
   amplification attacks (see Section 5.4.1).

5.3.2.3.  Attacks using the Nonce-Present and the Echo-Nonce bits

   The Nonce-Present and Echo-Nonce bits are used when verifying the
   reachability of a remote ETR.  Assume that LR3 wants to verify that
   LR1 receives the packets that it sends.  LR3 can set the Echo-Nonce
   and the Nonce-Present bits in LISP data encapsulated packets and
   include a random nonce in these packets.  Upon reception of these
   packets, LR1 will store the nonce sent by LR3 and echo it when it
   returns LISP encapsulated data packets to LR3.

   A spoofing off-path attacker (SA) could interfere with this
   reachability test by sending two different types of packets:

   1.  LISP data encapsulated packets with the Nonce-Present bit set and
       a random nonce and the appropriate source and destination RLOCs.

   2.  LISP data encapsulated packets with the Nonce-Present and the
       Echo-Nonce bits both set and the appropriate source and
       destination RLOCs.  These packets will force the receiving ETR to
       store the received nonce and echo it in the LISP encapsulated
       packets that it sends.

   The first type of packet should not cause any major problem to ITRs.
   As the reachability test uses a 24 bits nonce, it is unlikely that an
   off-path attacker could send a single packet that causes an ITR to
   believe that the ETR it is testing is reachable while in reality it
   is not reachable.  To increase the success likelihood of such attach,
   the attacker should created a massive amount of packets carrying all
   possible nonce values.

   The second type of packet could be exploited to attack the nonce-
   based reachability test.  Consider a spoofing off-path attacker (SA)
   that sends a continuous flow of spoofed LISP data encapsulated
   packets that contain the Nonce-Present and the Echo-Nonce bit and
   each packet contains a different random nonce.  The ETR that receives
   such packets will continuously change the nonce that it returns to
   the remote ITR.  If the remote ITR starts a nonce-reachability test,
   this test may fail because the ETR has received a spoofed LISP data
   encapsulated packet with a different random nonce and never echoes
   the real nonce.  In this case the ITR will consider the ETR not
   reachable.  The success of this test depends on the ratio between the



Saucez, et al.           Expires April 05, 2014                [Page 10]


Internet-Draft                LISP Threats                  October 2013


   amount of packets sent by the legitimate ITR and the spoofing off-
   path attacker (SA).

5.3.2.4.  Attacks using the Instance ID bits

   LISP allows to carry in its header a 24-bits value called "Instance
   ID" and used on the ITR to indicate which local Instance ID has been
   used for encapsulation, while on the ETR can be used to select the
   forwarding table used for forwarding the decapsulated packet.

   The Instance ID increases exposure to attacks ([RFC6169]) as if an
   off-path attacker can randomly guess a valid Instance ID value she
   gets access to network that she might not have access.  However, the
   impact of such attack is directly on end-systems which is is out of
   the scope of this document.

5.4.  Attack using the control-plane

   In this section, we discuss the different types of attacks that could
   occur when an off-path attacker sends control-plane packets.  We
   focus on the packets that are sent directly to the ETR and do not
   analyze the particularities of a LISP mapping system.

5.4.1.  Attacks with Map-Request messages

   An off-path attacker could send Map-Request packets to a victim ETR.
   In theory, a Map-Request packet is only used to solicit an answer and
   as such it should not lead to security problems.  However, the LISP
   specification [RFC6830] contains several particularities that could
   be exploited by an off-path attacker.

   The first possible exploitation is the P bit.  The P bit is used to
   probe the reachability of remote ETRs.  In our reference environment,
   LR3 could probe the reachability of LR1 by sending a Map-Request with
   the P bit set.  LR1 would reply by sending a Map-Reply message with
   the P bit set and the same nonce as in the Map-Request message.

   A spoofing off-path attacker (SA) could use the P bit to force a
   victim ETR to send a Map-Reply to the spoofed source address of the
   Map-Request message.  As the Map-Reply can be larger than the Map-
   Request message, there is a risk of amplification attack.
   Considering only IPv6 addresses, a Map-Request can be as small as 40
   bytes, considering one single ITR address and no Mapping Protocol
   Data.  The Map-Reply instead has a size of O(12 + (R * (28 + N *
   24))) bytes, where N is the maximum number of RLOCs in a mapping and
   R the maximum number of records in a Map-Reply.  Since up to 255
   RLOCs can be associated to an EID-Prefix and 255 records can be
   stored in a Map-Reply, the maximum size of a Map-Reply is thus above



Saucez, et al.           Expires April 05, 2014                [Page 11]


Internet-Draft                LISP Threats                  October 2013


   1 MB showing a size factor of up to 39,193 between the message sent
   by the attacker and the message sent by the ETR.  These numbers are
   however theoretical values not considering transport layer
   limitations and it is more likely that the reply will contain only
   one record with at most a dozen of locators, giving an amplification
   factor around 8.

   Similarly, if a non-spoofing off-path attacker (NSA) sends a Map-
   Request with the P bit set, it will receive a Map-Reply with the P
   bit set.

   An amplification attack could be launched by a spoofing off-path
   attacker (SA) as follows.  Consider an attacker SA and EID-Prefix
   192.0.2.0/24 and a victim ITR, SA could send spoofed Map-Request
   messages whose source EID addresses are all the addresses inside
   192.0.2.0/24 and source RLOC address is the victim ITR.  Upon
   reception of these Map-Request messages, the ETR would send large
   Map-Reply messages for each of the addresses inside p/P back to the
   victim ITR.

   The Map-Request message may also contain the SMR bit.  Upon reception
   of a Map-Request message with the SMR bit, an ETR must return to the
   source of the Map-Request message a Map-Request message to retrieve
   the corresponding mapping.  This raises similar problems as the P bit
   discussed above except that as the Map-Request messages are smaller
   than Map-Reply messages, the risk of amplification attacks is
   reduced.  This is not true anymore if the ETR append to the Map-
   Request messages its own Map-Records.  This mechanism is meant to
   reduce the delay in mapping distribution since mapping information is
   provided in the Map-Request message.

   Furthermore, appending Map-Records to Map-Request messages allows an
   off-path attacker to generate a (spoofed or not) Map-Request message
   and include in the Map-Reply portion of the message mapping for EID
   prefixes that it does not serve.

   Moreover, attackers can use Map Resolver and/or Map Server network
   elements to perform relay attacks.  Indeed, on the one hand, a Map
   Resolver is used to dispatch Map-Request to the mapping system and,
   on the other hand, a Map Server is used to dispatch Map-Requests
   coming from the mapping system to ETRs that are authoritative for the
   EID in the Map-Request.









Saucez, et al.           Expires April 05, 2014                [Page 12]


Internet-Draft                LISP Threats                  October 2013


5.4.2.  Attacks with Map-Reply messages

   In this section we analyze the attacks that could occur when an off-
   path attacker sends directly Map-Reply messages to ETRs without using
   one of the proposed LISP mapping systems.

   There are two different types of Map-Reply messages:

   Positive Map-Reply:  These messages contain a Map-Record binding an
         EID-Prefix to one or more RLOCs.

   Negative Map-Reply:  These messages contain a Map-Record for an EID-
         Prefix with an empty locator-set and specifying an action,
         which may be either Drop, natively forward, or Send Map-
         Request.

   Positive Map-Reply messages are used to map EID-Prefixes onto RLOCs.
   Negative map-reply messages are used to indicate non-lisp prefixes.
   ITRs can, if needed, be configured to send all traffic destined for
   non-lisp prefixes to a Proxy-ETR.

   Most of the security of the Map-Reply messages depends on the 64 bits
   nonce that is included in a Map-Request and returned in the Map-
   Reply. f an ETR does not accept Map-Reply messages with an invalid
   nonce, the risk of attack is acceptable given the size of the nonce
   (64 bits).  However, the nonce only confirms that the map-reply
   received was sent in response to a map-request sent, it does not
   validate the contents of that map-reply.

   In addition, an attacker could perform EID-to-RLOC Cache overflow
   attack by de-aggregating (i.e., splitting an EID prefix into
   artificially smaller EID prefixes) either positive or negative
   mappings.

   In presence of malicious ETRs, overclaiming attacks are possible.
   Such an attack happens when and ETR replies to a legitimate Map-
   Request message it received with a Map-Reply message that contains an
   EID-Prefix that is larger than the prefix owned by the site that
   encompasses the EID of the Map-Request.  For instance if the prefix
   owned by the site is 192.0.2.0/25 but the Map-Reply contains a
   mapping for 192.0.2.0/24, then the mapping will influence packets
   destined to other EIDs than the one the LISP site has authority on.

   A malicious ETR might also fragment its EID-to-RLOC database so that
   ITR's might have to install much more mappings than really necessary.
   This attack is called de-aggregation attack.





Saucez, et al.           Expires April 05, 2014                [Page 13]


Internet-Draft                LISP Threats                  October 2013


5.4.3.  Attacks with Map-Register messages

   Map-Register messages are sent by ETRs to indicate to the mapping
   system the EID prefixes associated to them.  The Map-Register message
   provides an EID prefix and the list of ETRs that are able to provide
   Map-Replies for the EID covered by the EID prefix.

   As Map-Register messages are protected by an authentication
   mechanism, only a compromised ETR can register itself to its
   allocated Map Server.

   A compromised ETR can perform an overclaiming attack in order to
   influence the route followed by Map-Requests for EIDs outside the
   scope of its legitimate EID prefix.

   A compromised ETR can also perform a deaggregation attack in order to
   register more EID prefixes than necessary to its Map Servers.

5.4.4.  Attacks with Map-Notify messages

   Map-Notify messages are sent by a Map Server to an ETR to acknowledge
   the good reception and processing of a Map-Register message.

   A spoofing attacker compromised ETR can send a Map-Register with the
   M-bit set and a spoofed source address to force the Map Server to
   send a Map-Notify message to the spoofed address and then succeed a
   relay attack.  Similarly to the pair Map-Request/Map-Reply, the pair
   Map-Register/Map-Notify is protected by a nonce making hard for an
   attacker to inject a falsified notification to an ETR to make this
   ETR believe that the registration succeeded while it has not.

6.  Attack categories

6.1.  Intrusion

6.1.1.  Description

   With an intrusion attack an attacker gains remote access to some
   resources (e.g., a host, a router, or a network) that are normally
   denied to her.

6.1.2.  Vectors

   Intrusion attacks can be mounted using:

   o  Spoofing EID or RLOCs

   o  Instance ID bits



Saucez, et al.           Expires April 05, 2014                [Page 14]


Internet-Draft                LISP Threats                  October 2013


6.2.  Denial of Service (DoS)

6.2.1.  Description

   A Denial of Service (DoS) attack aims at disrupting a specific
   targeted service either by exhausting the resources of the victim up
   to the point that it is not able to provide a reliable service to
   legit traffic and/or systems or by exploiting vulnerabilities to make
   the targeted service unable to operate properly.

6.2.2.  Vectors

   Denial of Service attacks can be mounted using

   o  Gleaning

   o  Interworking

   o  Locator Status Bits

   o  Map-Version bit

   o  Nonce-Present and Echo-Nonce bits

   o  Map-Request message

   o  Map-Reply message

   o  Map-Register message

   o  Map-Notify message

6.3.  Eavesdropping

6.3.1.  Description

   With an eavesdropping attack, the attacker collects traffic of a
   target through deep packet inspection in order to gain access to
   restricted or sensitive information such as passwords, session
   tokens, or any other confidential information.  This type of attack
   is usually carried out in a way such that the target does not even
   notice the attack.  When the attacker is positioned on the path of
   the target traffic, it is called a Man-in-the-Middle attack.
   However, this is not a requirement to carry out and eavesdropping
   attack.  Indeed the attacker might be able, for instance through an
   intrusion attack on a weaker system, either to duplicate or even re-
   direct the traffic, in both cases having access to the raw packets.




Saucez, et al.           Expires April 05, 2014                [Page 15]


Internet-Draft                LISP Threats                  October 2013


6.3.2.  Vectors

   Eavesdropping attacks can be mounted using

   o  Gleaning

   o  Locator Status Bits

   o  Nonce-Present and the Echo-Nonce bits

   o  Map-Request messages

   o  Map-Reply messages

7.  Recommendations

   TBD

8.  IANA Considerations

   This document makes no request to IANA.

9.  Security Considerations

   Security considerations are the core of this document and do not need
   to be further discussed in this section.

10.  Acknowledgments

   This document builds upon the draft of Marcelo Bagnulo
   ([I-D.bagnulo-lisp-threat]), where the flooding attack and the
   reference environment were first described.

   The authors would like to thank Florin Coras, Vina Ermagan, Darrel
   Lewis, and Jeff Wheeler for their comments.

   This work has been partially supported by the INFSO-ICT-216372
   TRILOGY Project (www.trilogy-project.org).

11.  References

11.1.  Normative References

   [RFC6169]  Krishnan, S., Thaler, D., and J. Hoagland, "Security
              Concerns with IP Tunneling", RFC 6169, April 2011.






Saucez, et al.           Expires April 05, 2014                [Page 16]


Internet-Draft                LISP Threats                  October 2013


   [RFC6830]  Farinacci, D., Fuller, V., Meyer, D., and D. Lewis, "The
              Locator/ID Separation Protocol (LISP)", RFC 6830, January
              2013.

   [RFC6832]  Lewis, D., Meyer, D., Farinacci, D., and V. Fuller,
              "Interworking between Locator/ID Separation Protocol
              (LISP) and Non-LISP Sites", RFC 6832, January 2013.

   [RFC6833]  Fuller, V. and D. Farinacci, "Locator/ID Separation
              Protocol (LISP) Map-Server Interface", RFC 6833, January
              2013.

   [RFC6834]  Iannone, L., Saucez, D., and O. Bonaventure, "Locator/ID
              Separation Protocol (LISP) Map-Versioning", RFC 6834,
              January 2013.

   [RFC6836]  Fuller, V., Farinacci, D., Meyer, D., and D. Lewis,
              "Locator/ID Separation Protocol Alternative Logical
              Topology (LISP+ALT)", RFC 6836, January 2013.

   [RFC6837]  Lear, E., "NERD: A Not-so-novel Endpoint ID (EID) to
              Routing Locator (RLOC) Database", RFC 6837, January 2013.

11.2.  Informative References

   [Chu]      Jerry Chu, H., "Tuning TCP Parameters for the 21st Century
              ", 75th IETF, Stockholm, July 2009,
              <http://tools.ietf.org/wg/savi/>.

   [I-D.bagnulo-lisp-threat]
              Bagnulo, M., "Preliminary LISP Threat Analysis", draft-
              bagnulo-lisp-threat-01 (work in progress), July 2007.

   [I-D.ietf-lisp-ddt]
              Fuller, V., Lewis, D., Ermagan, V., and A. Jain, "LISP
              Delegated Database Tree", draft-ietf-lisp-ddt-01 (work in
              progress), March 2013.

   [I-D.ietf-lisp-sec]
              Maino, F., Ermagan, V., Cabellos-Aparicio, A., Saucez, D.,
              and O. Bonaventure, "LISP-Security (LISP-SEC)", draft-
              ietf-lisp-sec-04 (work in progress), October 2012.

   [I-D.ietf-tcpm-tcp-security]
              Gont, F., "Survey of Security Hardening Methods for
              Transmission Control Protocol (TCP) Implementations",
              draft-ietf-tcpm-tcp-security-03 (work in progress), March
              2012.



Saucez, et al.           Expires April 05, 2014                [Page 17]


Internet-Draft                LISP Threats                  October 2013


   [I-D.meyer-lisp-cons]
              Brim, S., "LISP-CONS: A Content distribution Overlay
              Network Service for LISP", draft-meyer-lisp-cons-04 (work
              in progress), April 2008.

   [I-D.saucez-lisp-mapping-security]
              Saucez, D. and O. Bonaventure, "Securing LISP Mapping
              replies", draft-saucez-lisp-mapping-security-00 (work in
              progress), February 2011.

   [RFC3704]  Baker, F. and P. Savola, "Ingress Filtering for Multihomed
              Networks", BCP 84, RFC 3704, March 2004.

   [RFC4301]  Kent, S. and K. Seo, "Security Architecture for the
              Internet Protocol", RFC 4301, December 2005.

   [RFC5386]  Williams, N. and M. Richardson, "Better-Than-Nothing
              Security: An Unauthenticated Mode of IPsec", RFC 5386,
              November 2008.

   [RFC6480]  Lepinski, M. and S. Kent, "An Infrastructure to Support
              Secure Internet Routing", RFC 6480, February 2012.

   [SAVI]     IETF, "Source Address Validation Improvements Working
              Group ", 2013, <http://tools.ietf.org/wg/savi/>.

   [Saucez09]
              Saucez, D. and L. Iannone, "How to mitigate the effect of
              scans on mapping systems ", Submitted to the Trilogy
              Summer School on Future Internet, 2009.

Appendix A.  Document Change Log

   o  Version 06 Posted October 2013.

      *  Complete restructuration, temporary version to be used at
         October 2013 interim meeting.

   o  Version 05 Posted August 2013.

      *  Removal of severity levels to become a short recommendation to
         reduce the risk of the discussed threat.

   o  Version 04 Posted February 2013.

      *  Clear statement that the document compares threats of public
         LISP deployments with threats in the current Internet
         architecture.



Saucez, et al.           Expires April 05, 2014                [Page 18]


Internet-Draft                LISP Threats                  October 2013


      *  Addition of a severity level discussion at the end of each
         section.

      *  Addressed comments from V. Ermagan and D. Lewis' reviews.

      *  Updated References.

      *  Further editorial polishing.

   o  Version 03 Posted October 2012.

      *  Dropped Reference to RFC 2119 notation because it is not
         actually used in the document.

      *  Deleted future plans section.

      *  Updated References

      *  Deleted/Modified sentences referring to the early status of the
         LISP WG and documents at the time of writing early versions of
         the document.

      *  Further editorial polishing.

      *  Fixed all ID nits.

   o  Version 02 Posted September 2012.

      *  Added a new attack that combines overclaiming and de-
         aggregation (see Section 5.4.2).

      *  Editorial polishing.

   o  Version 01 Posted February 2012.

      *  Added discussion on LISP-DDT.

   o  Version 00 Posted July 2011.

      *  Added discussion on LISP-MS>.

      *  Added discussion on Instance ID in Section 5.3.2.

      *  Editorial polishing of the whole document.

      *  Added "Change Log" appendix to keep track of main changes.

      *  Renamed "draft-saucez-lisp-security-03.txt.



Saucez, et al.           Expires April 05, 2014                [Page 19]


Internet-Draft                LISP Threats                  October 2013


Authors' Addresses

   Damien Saucez
   INRIA
   2004 route des Lucioles BP 93
   06902 Sophia Antipolis Cedex
   France

   Email: damien.saucez@inria.fr


   Luigi Iannone
   Telecom ParisTech
   23, Avenue d'Italie, CS 51327
   75214 PARIS Cedex 13
   France

   Email: luigi.iannone@telecom-paristech.fr


   Olivier Bonaventure
   Universite catholique de Louvain
   Place St. Barbe 2
   Louvain la Neuve
   Belgium

   Email: olivier.bonaventure@uclouvain.be
























Saucez, et al.           Expires April 05, 2014                [Page 20]