Re: AD Evaluation: draft-ietf-6man-predictable-fragment-id

[Fernando Gont <[e-mail]>]

Hi, Brian,

Thanks so much for your feedback! -- Please find my responses in-line....

On 08/21/2015 08:16 PM, Brian Haberman wrote:
>      I have completed my AD evaluation of this draft as a part of the
> publication process.  I only have two comments/questions on this draft.
> Once those are resolved, it can move along in the publication process.
> 
> * Section 4 says the following:
> 
>    As a result, at least during the IPv6/IPv4 transition/co-existence
>    phase, it is probably safer to assume that only the low-order 16 bits
>    of the IPv6 Fragment Identification are of use to the destination
>    system.
> 
> I think that statement is making an ill-advised generalization.  The
> above is true if one is looking at an atomic fragment. However, even if
> we are talking about a transition/co-existence phase, there will still
> be significant amounts of fragmented traffic between IPv6 nodes where
> the full 32 bits of the fragment id are useful. What was the rationale
> for the above generalization?

The rationale is that, since you don't really know whether the remote
endpoint is really an IPv6 node or an IPv4 node behind a translator, the
only safe bet is to assume the worst ("it is a v4 node behind a
translator, and hence only the low order 16 bits are meaningful").



> * Section 5.3's discussion of a hash-based id generation scheme says
> this in the drawbacks:
> 
>    o  Since the Fragment Identification values are predictable by the
>       destination host...
> 
> How are the ID values predicted by the destination host?  The source is
> using secret values that presumably are not shared with the destination.
> So how does this prediction work?

These Frag ID values are predictable because the hash-based approach
leads to a monotonically-increasing sequence (e.g., 1, 2, 3, 4) then
it's easy to predict the sequence *by the destination host*. Of course,
such sequence is not predictable by an off-path attacker.

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492