Chairs Review on <draft-ietf-6man-predictable-fragment-id-02>

[Bob Hinden <[e-mail]>]

The chairs have completed our review of this draft and have issues we would like to raise.  Some are for the author, and some are for for the working group.  Our comments range from serious to editorial.

Please review and send us your comments.

Thanks,
Bob & Ole

-------

Serious

The biggest issue is if advancing and publishing this draft is worthwhile.  We note that in Appendix B "Survey of Fragment Identification selection algorithms employed by popular IPv6 implementations”, of the implementation listed, all of the current ones (FreeBSD 9, Linux-current, OpenBSD-current) show unpredictable or random.  While there are many older obsolete operating systems that have issues, we aren’t going to fix these by publishing this draft.  The report does not list current versions of Windows (9 or 10), nor any mobile OS’s (though, IOS and Android are based on BSD and Linux respectively).  We wonder what will achieved by publishing this RFC since it appears that current shipping operating systems don’t have the issue.  This is a question for the working group.

Moderate

In Section 2 "Security Implications of Predictable Fragment Identification values”.  The problems listed seem to us to be overstated.  As the draft notes later, the issue with predictable fragment IDs in IPv6 is only an issue for IPv6 packets with the fragment header.  Traffic that doesn’t include a fragment header is, of course, immune.  This alone reduces the severity of the problems listed.  We don’t think the draft makes this clear.  We agree it is possible for an attacker to cause a host to respond with a fragmented packet making the Fragment ID visible to this won’t give the attacker any visibility into the non-fragmented traffic the host is sending.  The significantly reduces the severity of the items listed.

On Page 5 of Section 2, the draft cites problems with Linux 2.6.38-8.  This is an old version of the Linux kernel and we don’t think it justifies the problem, especially since according to the appendix it is fixed in later version of the Linux kernel.

In the second paragraph of Section 2., it says

 [CPNI-IPv6] contains a detailed analysis of possible vulnerabilities
 introduced by predictable Fragment Identification values.

This appears to be a significant part of the justification.  However, when looking at the reference it says:

 [CPNI-IPv6]  Gont, F., "Security Assessment of the Internet Protocol
              version 6 (IPv6)", UK Centre for the Protection of
              National Infrastructure, (available on request).

Including a reference that isn’t generally available, appears to be an issue to us if this is part of the justification for this work.  Has anyone in the working group reviewed it?  We suggest it be removed or the document referenced be made available on a stable web site.

Editorial

Abstract.
OLD:
Some implementations use simple a global counter for
setting the Identification field, thus leading to predictable values.

NEW:
Some implementations use a simple global counter for
setting the Identification field, thus leading to predictable values.

Issue #2:
Remove:  [I-D.ietf-6man-deprecate-atomfrag-generation] aims at deprecating the
generation of IPv6 atomic fragments.

Issue #3:
s/DoS/DoS attack/
"DoS" isn't a verb.

Issue #4:
OLD:
From a security standpoint, unpredictable Identification values are
desirable.  However, this is somewhat at odds with the "re-use"
requirements specified in [RFC2460].

NEW:
From a security standpoint, unpredictable Identification values are
desirable.  However, this is somewhat at odds with the "re-use"
requirements specified in [RFC2460], that specifies that an Identification
value must be different than that of any other fragment sent recently.

Issue #5:
Section 4.1 Add reference RFC4861 for "Destination cache"

Issue #6:
References: Remove [I-D.ietf-6man-deprecate-atomfrag-generation]