View source for Secure Neighbor Discovery

{{Short description|IPv6 network protocol extension}}
{{no footnotes|date=January 2011}}

The '''Secure Neighbor Discovery''' ('''SEND''') protocol is a security extension of the [[Neighbor Discovery Protocol]] (NDP) in [[IPv6]] defined in RFC 3971 and updated by RFC 6494.

The [[Neighbor Discovery Protocol]] (NDP) is responsible in [[IPv6]] for discovery of other network nodes on the local link, to determine the link layer addresses of other nodes, and to find available routers, and maintain reachability information about the paths to other active neighbor nodes (RFC 4861). NDP is insecure<ref>[https://community.infoblox.com/t5/IPv6-CoE-Blog/Holding-IPv6-Neighbor-Discovery-to-a-Higher-Standard-of-Security/ba-p/3470 Holding IPv6 Neighbor Discovery to a Higher Standard of Security], community.infoblox.com, 2.10.2015</ref> and susceptible to malicious interference. It is the intent of SEND to provide an alternate mechanism for securing NDP with a cryptographic method that is independent of [[IPsec]], the original and inherent method of securing IPv6 communications.

SEND uses [[Cryptographically Generated Address]]es (CGA) and other new NDP options for the [[ICMPv6]] packet types used in NDP.

SEND was updated to use the [[Resource Public Key Infrastructure]] (RPKI) by RFC 6494 and RFC 6495 which define use of a SEND Certificate Profile utilizing a modified RFC 6487 RPKI Certificate Profile which must include a single RFC 3779 IP Address Delegation extension.

There have been concerns with algorithm agility vis-à-vis attacks on hash functions used by SEND expressed in RFC 6273, as CGA currently uses the [[SHA-1]] hash algorithm and PKIX certificates and does not provide support for alternative hash algorithms.

==Implementations==
* [http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/15-2mt/ip6-send.html Cisco IOS 12.4(24)T and newer]
* [http://mobisend.org/software.html Docomo USL SEND fork]{{dead link|date=May 2018 |bot=InternetArchiveBot |fix-attempted=yes }}
* [http://sourceforge.net/projects/easy-send/ Easy-SEND]
* [http://code.google.com/p/ipv6-send-cga/ ipv6-send-cga], [[Huawei]] and [[Beijing University of Posts and Telecommunications]]
* [https://web.archive.org/web/20110811105850/http://amnesiak.org/NDprotector/ NDprotector], [[Telecom SudParis]]
* [http://code.google.com/p/google-summer-of-code-2009-freebsd/downloads/detail?name=Ana_Kukec.tar.gz Native SeND kernel API]
* [http://www.trustrouter.net/ TrustRouter]
* [https://web.archive.org/web/20110710143008/http://www.docomolabs-usa.com/lab_opensource.html USL SEND] (discontinued), [[NTT DoCoMo]]
* [https://hpi.de/meinel/security-tech/next-generation-security-engineering/ipv6-security/winsend.html WinSEND]

==See also==
* [[Neighbor Discovery Protocol]]

== References ==
<references />
{{refbegin}}
* {{cite IETF |RFC=3971 |title=Secure Neighbor Discovery (SEND) |editor=J.Arkko |display-authors=etal |date=March 2005}}
* {{cite IETF |RFC=4861 |title=Neighbor Discovery for IP version 6 (IPv6) |author=T.Narten |display-authors=etal |date=September 2007}}
* {{cite IETF |RFC=6494 |title=Certificate Profile and Certificate Management for SEcure Neighbor Discovery (SEND) |author=R. Gagliano |display-authors=etal |date=February 2012}}
{{refend}}

[[Category:Internet protocols]]
[[Category:Cryptographic protocols]]
[[Category:Link protocols]]
[[Category:IPv6]]


{{compu-network-stub}}
{{IPv6}}