6lo P. Thubert Internet-Draft Updates: 8928 (if approved) A. Rashid Intended status: Standards Track P Bari Expires: 16 October 2025 14 April 2025 Moving the C Flag in EARO draft-ietf-6lo-updating-rfc-8928-00 Abstract This document updates RFC 8928, “Address-Protected Neighbor Discovery for Low-Power and Lossy Networks” (AP-ND), by explicitly specifying the bit position for the “C” flag and registering it with IANA. This clarification ensures consistent implementation and interoperability of the AP-ND protocol, which protects against address theft and impersonation attacks in Low-Power and Lossy Networks (LLNs). This update provides a precise definition of the “C” flag’s bit position, enabling correct deployment and verification of AP-ND’s security features. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 16 October 2025. Copyright Notice Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/ license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights Thubert & Rashid Expires 16 October 2025 [Page 1] Internet-Draft UPD RFC 8928 April 2025 and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 3 2.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 2.2. References . . . . . . . . . . . . . . . . . . . . . . . 3 2.3. Acronyms . . . . . . . . . . . . . . . . . . . . . . . . 4 3. Updating RFC 8928 . . . . . . . . . . . . . . . . . . . . . . 4 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 5 4.1. Bit Position of the "C" Flag . . . . . . . . . . . . . . 5 5. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 6 6. Normative References . . . . . . . . . . . . . . . . . . . . 6 7. Informative References . . . . . . . . . . . . . . . . . . . 7 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 7 1. Introduction The classical Neighbor Discovery (IPv6 ND) Protocol [RFC4861] [RFC4862] was defined for serial links and shared transit media such as Ethernet at a time when broadcast was cheap on those media while memory for neighbor cache was expensive. It was thus designed as a reactive protocol that relies on caching and multicast operations for the Address Resolution (AR, aka Address Discovery or Address Lookup) and Duplicate Address Detection (DAD) of IPv6 unicast addresses. Those multicast operations typically impact every node on-link when at most one is really targeted, which is a waste of energy, and imply that all nodes are awake to hear the request, which is inconsistent with power saving (sleeping) modes. Low-Power Personal Area Networks (LoWPANs) require an optimized IPv6 Neighbor Discovery due to resource constraints and high multicast overhead. To address this, 6LoWPAN ND [RFC6775], [RFC8505], [RFC8929], [RFC9685], [I-D.ietf-6lo-prefix-registration] introduces a unicast, anycast, and multicast Address Registration (AR) mechanism as well as a Prefix Registration (PR) mechanism. Staring with [RFC8505], the registration mechanism uses the Extended Address Registration Option (EARO), significantly reducing reliance on multicast for Duplicate Address Detection (DAD). In these networks, the 6LoWPAN Border Router (6LBR) serves as a central repository for registered addresses. 6LoWPAN ND is being generalized to NBMA networks as Subnet Neighbor Discovery (SND), see [I-D.ietf-6man-ipv6-over-wireless]. Thubert & Rashid Expires 16 October 2025 [Page 2] Internet-Draft UPD RFC 8928 April 2025 For enhanced security, [RFC8505] introduces a Registration Ownership Verifier (ROVR) in the EARO. Building on this, the "Address-Protected Neighbor Discovery for LLNs" [RFC8928], protects the ownership of unicast IPv6 addresses registered with [RFC8505]. In this framework, a node auto-configures a public/private key pair and signs its address registrations, enabling the first-hop router (6LoWPAN Router (6LR)) to validate registrations and perform source address verification. However, the “Address-Protected Neighbor Discovery for Low-Power and Lossy Networks” [RFC8928] (AP-ND), initially defined the “C” flag in EARO, later on [RFC9685] defined the P-Field in bits 2 and 3 of the EARO flags with proper IANA registration, causing an overlap with Figure 1 of [RFC8928] which depicts the location of the “C” flag. This specification updates [RFC8928] by repositioning the “C” flag as bit 1 of the EARO flag avoiding conflicts. 2. Terminology 2.1. Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here. 2.2. References This document uses terms and concepts that are discussed in: * Neighbor Discovery for IP version 6 [RFC4861] * IPv6 Stateless Address Autoconfiguration [RFC4862] * Neighbor Discovery Optimization for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs) [RFC6775] * Registration Extensions for IPv6 over Low-Power Wireless Personal Area Network (6LoWPAN) Neighbor Discovery [RFC8505] * IPv6 Backbone Router [RFC8929] * Address-Protected Neighbor Discovery for Low-Power and Lossy Networks [RFC8928] * Listener Subscription for IPv6 Neighbor Discovery Multicast and Anycast Addresses [RFC9685] Thubert & Rashid Expires 16 October 2025 [Page 3] Internet-Draft UPD RFC 8928 April 2025 2.3. Acronyms This document uses the following abbreviations: 6LN: 6LoWPAN Node 6LBR: 6LoWPAN Border Router 6LR: 6LoWPAN Router AP-ND: Address-Protected Neighbor Discovery ARO: Address Registration Option DAD: Duplicate Address Detection EARO: Extended Address Registration Option LLN: Low-Power and Lossy Network LoWPAN: Low-Rate Personal Area Network (IEEE Std. 802.15.4) [IEEE802154] NDP: Neighbor Discovery Protocol ROVR: Registration Ownership Verifier SND: Subnet Neighbor Discovery TID: Transaction ID 3. Updating RFC 8928 The "Address-Protected Neighbor Discovery for Low-Power and Lossy Networks" [RFC8928] was defined to protect the ownership of unicast IPv6 addresses that are registered with [RFC8505]. In [RFC8928], the "C" flag is shown in the EARO flags field at bit position 3 (as depicted in Figure 1 of [RFC8928]); however, it does not explicitly specify the bit number and fails to register its position with IANA. Later, [RFC9685] defined the P-Field in bits 2 and 3 of the EARO flags field and obtained proper IANA registration, but this introduced an overlap with the representation in [RFC8928]. To resolve the conflict, this specification updates [RFC8928] by repositioning the "C" flag to bit 1 of the EARO flags field, thereby avoiding the overlapping definitions. 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Type | Length |F|PrefixLength | Opaque | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |R|C| P | I |R|T| TID | Registration Lifetime | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | ... Registration Ownership Verifier ... | (64, 128, 192, or 256 bits) | | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Thubert & Rashid Expires 16 October 2025 [Page 4] Internet-Draft UPD RFC 8928 April 2025 Figure 1: Extended Address Registration Option (EARO) Format in NS messages Option Fields of interest for this specification: *Type:* 33 *Length:* Defined in [RFC8505] and copied in the "EARO Length" field in the associated Crypto-ID Parameters Option (CIPO). *Status:* Defined in [RFC8505]. *Opaque:* Defined in [RFC8505]. *R (Reserved):* 1-bit unsigned integer. It MUST be set to zero by the sender and MUST be ignored by the receiver. *C:* 1-bit flag, moved from its position in Figure 1 of [RFC8928]. It is set to indicate that the ROVR field contains a Crypto-ID and that the 6LN MAY be challenged for ownership. *P:* 2-bit P-Field *I, R, T:* Defined in [RFC8505]. *TID and Registration Lifetime:* Defined in [RFC8505]. *Registration Ownership Verifier (ROVR):* When the "C" flag is set, this field contains a Crypto-ID. 4. IANA Considerations 4.1. Bit Position of the "C" Flag This specification updates the location of the "C" flag introduced in [RFC8928] to position it as bit 1 in the EARO flags. IANA is requested to make an addition to the "Address Registration Option Flags" [IANA.ICMP.ARO.FLG] registry under the heading "Internet Control Message Protocol version 6 (ICMPv6) Parameters" as indicated in Table 1: +---------------+----------+-----------+ | ARO flag | Meaning | Reference | +---------------+----------+-----------+ | 1 (suggested) | "C" Flag | RFC 8928 | +---------------+----------+-----------+ Table 1: Bit Position of the "C" Flag Thubert & Rashid Expires 16 October 2025 [Page 5] Internet-Draft UPD RFC 8928 April 2025 5. Acknowledgments Many thanks to Dave Thaler and Dan Romascanu for their early INT-DIR review. 6. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, DOI 10.17487/RFC2119, March 1997, . [RFC4861] Narten, T., Nordmark, E., Simpson, W., and H. Soliman, "Neighbor Discovery for IP version 6 (IPv6)", RFC 4861, DOI 10.17487/RFC4861, September 2007, . [RFC4862] Thomson, S., Narten, T., and T. Jinmei, "IPv6 Stateless Address Autoconfiguration", RFC 4862, DOI 10.17487/RFC4862, September 2007, . [RFC6775] Shelby, Z., Ed., Chakrabarti, S., Nordmark, E., and C. Bormann, "Neighbor Discovery Optimization for IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs)", RFC 6775, DOI 10.17487/RFC6775, November 2012, . [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174, May 2017, . [RFC8505] Thubert, P., Ed., Nordmark, E., Chakrabarti, S., and C. Perkins, "Registration Extensions for IPv6 over Low-Power Wireless Personal Area Network (6LoWPAN) Neighbor Discovery", RFC 8505, DOI 10.17487/RFC8505, November 2018, . [RFC8928] Thubert, P., Ed., Sarikaya, B., Sethi, M., and R. Struik, "Address-Protected Neighbor Discovery for Low-Power and Lossy Networks", RFC 8928, DOI 10.17487/RFC8928, November 2020, . [IANA.ICMP.ARO.FLG] IANA, "IANA Registry for the Address Registration Option Flags", IANA, https://www.iana.org/assignments/icmpv6- parameters/icmpv6-parameters.xhtml#icmpv6-adress- registration-option-flags. Thubert & Rashid Expires 16 October 2025 [Page 6] Internet-Draft UPD RFC 8928 April 2025 [RFC9685] Thubert, P., Ed., "Listener Subscription for IPv6 Neighbor Discovery Multicast and Anycast Addresses", RFC 9685, DOI 10.17487/RFC9685, November 2024, . 7. Informative References [IEEE802154] IEEE standard for Information Technology, "IEEE Std 802.15.4, Part. 15.4: Wireless Medium Access Control (MAC) and Physical Layer (PHY) Specifications for Low-Rate Wireless Personal Area Networks". [RFC8929] Thubert, P., Ed., Perkins, C.E., and E. Levy-Abegnoli, "IPv6 Backbone Router", RFC 8929, DOI 10.17487/RFC8929, November 2020, . [I-D.ietf-6lo-prefix-registration] Thubert, P., "IPv6 Neighbor Discovery Prefix Registration", Work in Progress, Internet-Draft, draft- ietf-6lo-prefix-registration-07, 25 March 2025, . [I-D.ietf-6man-ipv6-over-wireless] Thubert, P. and M. Richardson, "Architecture and Framework for IPv6 over Non-Broadcast Access", Work in Progress, Internet-Draft, draft-ietf-6man-ipv6-over-wireless-07, 23 November 2024, . Authors' Addresses Pascal Thubert 06330 Roquefort-les-Pins France Email: pascal.thubert@gmail.com Adnan Rashid Politecnico di Bari Via Edoardo Orabona 4 70126 Bari Italy Email: adnan.rashid@poliba.it Thubert & Rashid Expires 16 October 2025 [Page 7]