Re: you have running code ... I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

[Alexandre Petrescu <[e-mail]>]

Le 05/11/2018 à 12:15, Nick Hilliard a écrit :
> Brian E Carpenter wrote on 05/11/2018 07:38:
>> And yes, a host MAY ignore it (that's the complement to the SHOULD
>> in the draft). We've never said anything else.
> 
> yes, but you have stated "On an IPv6-Only link, IPv4 might be used for 
> malicious purposes and pass unnoticed by IPv6-Only monitoring mechanisms".
> 
> If you want ipv6only-flag to be advisory, then you need to remove this 
> bullet-point from the document because the presence or absence of an RA 
> with ipv6only-flag set will not have any effect on malicious use of ipv4 
> on an otherwise "ipv6-only" network.
> 
> You cannot use security to justify something unless the proposal 
> provides a mechanism for enforcement; if you have no means of 
> enforcement, it's fluff, not security.

Well there is the Secure Neighbor Discovery protocol (SeND).  With it 
one can claim the link to be secure if IPv6-Only and insecure if IPv4 is 
present.

Simpler but less strong than SeND, there can be mechanisms to ensure a 
certain level of security, about the MAC address in the L2 header of the RA.

Alex

> 
> Nick
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>