IPv6 security - Addressing and auto-configuration

The IPv4 protocol suffers from a number of weaknesses. The main problem is address space. IPv4 addresses have a length of 32 bits, which represents some 4 billion possible addresses. With the explosive growth of the Internet and the waste of addresses due to the class structure, the number of IPv4 addresses has become insufficient.

Another problem is the saturation of routing tables in the Internet's main routers. Although emergency measures were taken as early as 1993, these only served to postpone the deadline. In 1994, the Internet Engineering Task Force (IETF) launched work to specify the Internet protocol that would replace IPv4: this protocol is IPv6.

This article describes :

• the different IPv6 address types and classes specified by the IETF ;

  the Neighbor Discovery Protocol (NDP), and the Stateless Address Autoconfiguration (SLAAC), an IPv6 address auto-configuration mechanism based on it;

• the NDP mechanism, necessary for NDP to function correctly in certain architectures.

Lastly, we discuss the following topics in turn:

• security flaws in the NDP mechanism ;

• palliative solutions to limit the latter;

• the SEcure Neighbor Discovery (SEND) mechanism, the IETF-standardized solution for securing the NDP mechanism, and the limitations of such a solution.