18

One of my friends is going to implement IPv6 in his university network environment and he told me it is more secure than IPv4. Is IPv6 more secure than IPv4? If so, how is it achieved on the protocol level?

  • 3
    IPv6 originally required IPSec, though now it's optional and IPv4 uses it too, so that's no longer a point of differentiation. So, my guess is that your friend just means that it has a wider address space for someone to brute-force search through it. Also, I guess since it avoids the need for NAT right now, that's a bonus. – Nat Jan 14 '17 at 23:25
13

Adding to what Chemical Engineer said, IPv6 does have other advantages too, such as:

  • Native support for end-to-end encryption: This was a feature that was added much later to IPv4, but comes as a standard for IPv6.

  • Secure neighbor discovery: The improved protocol (SEND) for neighbor discovery in IPv6 actually confirms the identity of the other party during host discovery, using a cryptographic method.

  • Larger address space: More time needed to bruteforce through addresses (3.4 × 1038 vs the older 4.3 × 109)

But as in most cases, misconfiguration will only make you more vulnerable.

Scott Hogg wrote a brilliant article a while ago here. It covers these points in much greater detail.

  • ...? How is this "3.4*10^38" calculated? – Michael Hampton Jan 15 '17 at 3:38
  • 1
    @MichaelHampton: It's 2^128. But it's actually inaccurate, because only a small fraction of that space has been allocated. But it's still far more than for IPv4. – Gordon Davisson Jan 15 '17 at 6:31
  • Yes, it would be more accurate to at least limit to 2001::/16 because that's what you would be seeing in practice on the Internet. (The actual allocation for Internet unicast is 2000::/3, but the only other actual allocation I know of within that is 3ffe::/16 which has been discontinued.) Also, no need to search subnets that haven't been allocated, so you can probably cut significant numbers of /48 allocations out of the search space. In practice this leaves you with some overhead to check what's been allocated, and somewhere around 30-35 bits of allocated address space at present. – a CVn Jan 15 '17 at 13:37
  • @MichaelHampton Indeed. I'm just lazy, so I didn't really get the numbers for allocated v4. – thel3l Jan 15 '17 at 14:19
  • 4
    @MichaelKjörling I have no reason to remember the number in that form. As for allocated ranges, there's more than just 2001 now. I've seen 2400, 2600, 2601, 2800, 2a01, ... – Michael Hampton Jan 15 '17 at 19:11
8

Summary: As currently implemented IPv6 networks might actually be less secure than IPv4. This is not because of the design IPv6 but because of inadequate support in firewalls and because network administrators and security specialist have more knowledge dealing with IPv4 than with IPv6.


It is true that IPv6 was designed with more security in mind. Unfortunately most of the good stuff like builtin IPSec was left out as optional which means that today's IPv6 connection are not better protected than IPv4.

Even worse is that many security products are not fully aware of IPv6 yet. Thus it is not uncommon that OpenVPN and other VPN installations only tunnel the IPv4 traffic but not the IPv6 traffic which obviously is a security problem. Also there are still firewalls which have none or limited support for IPv6 or have no optimizations for IPv6 and thus get slow with IPv6 traffic. Also, IPv6 networks behave slightly different than IPv4 networks (autoconfiguration, multiple IPv6 addresses on the same device...) which means that the existing IPv4 knowledge of network administrators and security professionals cannot be simply applied to IPv6. And then there is the different on-the-wire representation of IPv6 which features a fixed sized main header but then many stacked optional headers which represents a different set of challenges to deal with in firewalls than IPv4. And there are more differences which might cause unexpected behavior and thus security problems.

This together definitly does not make IPv6 more safe than IPv4 in practical use. In fact one might say that IPv6 is less secure in today's reality even though it was designed to be more secure. See also the many talks about this topic from conferences like Black Hat with topics like Evasion of High-End IPS Devices in the Age of IPv6 or Attacking IPv6 Implementation Using Fragmentation.

7

Sort of.

When IPv4 was designed, security was (intentionally, according to some participants) left out of the design; no encryption, no authentication, no identity verification.

IPv6 was an attempt to right the wrongs of IPv4, and this included the woeful lack of security. Features like encryption and strong identity were built into the protocol. But the design was slightly derailed by the design process (again, intentionally according to some) such that the security protocols are generally optional and often too complex to be usable.

So for the most part, the security of a well-run IPv4 network is roughly the same as that of a well-run IPv6 network. IPv6 in its typical form isn't inherently safer that IPv4 in its typical form.

There's a definite "security by obscurity" advantage in IPv6, though. Malware typically spreads over IPv4, and malware that scans the network for vulnerable targets uses IPv4 almost exclusively.

There's also the frequently-mentioned fact that picking random IPs in IPv6 space nearly always turns up unused addresses, but that's not a particularly strong protection. Choosing targets in IPv6 space won't happen by random selection or sequential scans. There are other ways to discover addresses.

  • But of course, the fact that IPv6's address space doesn't require NAT for local networks does encourage actual firewalling of hosts. NAT looks like a firewall, but it isn't one; with IPv6, if you want your hosts to not be accessible by all and sundry from the Internet, you pretty much need firewalling. (Well, there's NATv6, but really, what's the point of that?) – a CVn Jan 15 '17 at 13:40
  • -1 Security through obscurity is not security. Furthermore, plenty of malware that spreads over a network uses existing network libraries, making the exact IP version transparent to it. You can however say that the larger IPv6 space makes it impractical to scan any large section of the internet (as opposed to IPv4 where a couple gigabit lines can scan every address fairly quickly), making it harder to automate exploitation, but that would not be security through obscurity, as an increase in popularity of IPv6 would not change its size. – forest Jan 10 '18 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.