# Securing IPv6 Neighbor Discovery Address Resolution with Voucher-Based Addressing
###### Abstract  
The majority of local IPv6 networks continue to remain insecure and vulnerable to neighbor spoofing attacks. The Secure Neighbor Discovery (SEND) standard and its concomitant Cryptographically Generated Addressing (CGA) scheme were accepted by large standard bodies to codify practical mitigations. SEND and CGA have never seen widespread adoption due to their complexities, obscurity, costs, compatibility issues, and continued lack of mature implementations. In light of their poor adoption, research since their standardization has continued to find new perspectives and proffer new ideas. The orthodox solutions for securing Neighbor Discovery have historically struggled to successfully harmonize three core ideals: simplicity, flexibility, and privacy preservation. This research introduces Voucher-Based Addressing, a low-configuration, low-cost, and high-impact alternative to IPv6 address generation methods. It secures the Neighbor Discovery address resolution process while remaining simple, highly adaptable, indistinguishable, and privacy-focused. Applying a unique concoction of cryptographic key derivation functions, link-layer address binding, and neighbor consensus on the parameters of address generation, the resolved address bindings are verifiable without the need for complex techniques that have hindered the adoption of canonical specifications. IPv6; security; networking; NDP; neighbor discovery; spoofing; privacy; voucher-based addressing +
Footnote †: journal: Network  
0000-0001-4499-3300-3300][PERSON]  
0000-0001-449-3300-33  
obscurity of IPv6 outside of academia, networking enthusiast communities, or IETF circles, SEND and CGA descend into an even greater shroud of obscurity that unfortunately keeps them beyond the purview of the mainstream. Furthermore, any existing implementations of SEND and CGA are immature, having little to no backing or validation [7], and each implementation brings wildly varying effects on network performance across different systems [8]. Keeping in mind the mistakes of the past and the paths already paved, a new solution should be proposed for preventing NDP-driven on-path attacks. This solution should do so while remaining viable and efficient for all adopting devices, with a conception that necessitates the balance of three key aspects: privacy, flexibility, and simplicity. This research presents the Voucher-Based Addressing specification (VBA; also Voucher-Based Addresses, VBAs) to satisfy this requirement. VBA is a low-complexity, high-impact, privacy-conscious, optional proposal that secures local networks from NDP-based on-path threats via an alternative address generation technique. Interface link-layer addresses are bound to sets of deterministic IP addresses in a process which can be repeated by local neighbors to perform address verification. By coupling link-layer identifiers and network-layer identifiers together, the common NDP procedure for resolving this type of binding can guarantee that only legitimate bindings are used and statefully maintained. All generated addresses appear random to off-link nodes and potential trackers, which ensures node privacy, especially for mobile nodes. Locally distributed vouchers play a key role in controlling, obfuscating, and adjusting the parameters used to create and verify these resultant VBAs. A key purpose of this research is to produce an alternative to the widely accepted SEND and CGA standards--rather than augment, replace, or survey them--in order to foster new perspectives or to renew interest in solving these longstanding IPv6 security issues. Starting with Section 2, this work provides more background about the problem it attempts to solve and collates some other research which has been carried out to solve relevant NDP issues. A conceptual overview of VBA is given in Section 3. Relevant benchmarks and other experimental, implementation-based results are then described in Section 4. Section 5 includes a subsequent discussion of some of the miscellaneous practicalities of this work.