Re: Questions regarding the security mechanisms//RE: CRH and RH0

Very good point that from a security perspective most devices may not be
able to process CRH and to that end mentioning there CRH processing MUST be
disabled by default which drastically reduces if not eliminates any attack
vector.

Also any source CRH node wanting to steer packets over the internet or
private must be knowledgeable of the DA nodes IPv6 address hop by hop along
the steered path independent of domain specific properties as CRH has
ubiquitous use cases for traffic steering.  So in that context the each
node along the steered path must have manual enablement of CRH processing
and that in itself is your security.

All best practices of ACL Ingres and egress of domain specific security
would be maintained.

So if the CRH disabled by default and has to be purposely enabled for
steering intent based flow then I don’t think you need an infrastructure
ACL on each of the nodes along the steered path.

Kind regards

Gyan

On Sat, May 16, 2020 at 3:31 PM Nick Hilliard <nick@foobar.org> wrote:

> John Scudder wrote on 16/05/2020 20:18:
> > network. For this reason, I think the “complemented per-node
> > protection” is of little value. It may be of negative value if it
> > leads to a sense of complacency on the part of the victim.
>
> separate to this from a security point of view, there should be a knob
> to enable CRH processing, defaulting to off.  Suggested text:
>
> > Routers which process CRHs MUST have a configuration knob to
> > control whether CRH processing is enabled or not.  The default value
> > of this knob MUST be to disable CRH processing.
>
> Nick
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>
-- 

Gyan  Mishra

Network Engineering & Technology

Verizon

Silver Spring, MD 20904

Phone: 301 502-1347

Email: gyan.s.mishra@verizon.com