Re: [dna] next steps on draft-ietf-dna-simple

["Bernard Aboba" <[e-mail]>]

Jari said:

  Please add the following text to the end of the security
  considerations section:

  The DNA procedure does not in itself provide positive, secure 
  authentication of the router(s) on the network, or authentication of
  the network itself, as e.g. would be provided by mutual authentication
  at the link layer. Therefore when such assurance is not available, the
  host MUST NOT make any security-sensitive decisions based on the DNA
  procedure. In particular, it MUST NOT decide it has rejoined a network
  known to be physically secure, and proceed to abandon cryptographic
  protection.

[BA] Where SEND is in use, DNA *does* provide positive, secure
authentication of the router(s) on the network.  Also, the procedures
of Section 4.7.1 ensure that DNA does not override secure mechanisms
available on a network, such as DHCPv6 security or SEND.   Therefore,
DNA provides security equivalent to existing procedures. While it's 
true that a host should not make security decisions based on insecure
mechanisms (e.g. insecure DHCPv6 or RS/RA), that advice is not unique
to simple DNA. 

4) Lars Eggert was happy that the draft included retransmission rules, 
but noted that the draft should also set an upper limit on how many 
previous routers are probed.

  Please add the following text to end of Section 4.4:

  A Simple DNA implementation SHOULD limit probing to at most
  six previously seen routers.

[BA] This is fine; existing implementations typically have such a limit.