Re: Chairs Review on <draft-ietf-6man-predictable-fragment-id-02>

[Fernando Gont <[e-mail]>]

Hi, Bob,

On 05/19/2015 05:40 AM, Bob Hinden wrote:
>>>>> In Section 2 "Security Implications of Predictable Fragment 
>>>>> Identification values”.  The problems listed seem to us to
>>>>> be overstated.  As the draft notes later, the issue with 
>>>>> predictable fragment IDs in IPv6 is only an issue for IPv6 
>>>>> packets with the fragment header.
>>>> 
>>>> Yes, but you can trigger fragmentation for any traffic flow
>>>> (see draft-ietf-6man-deprecate-atomfrag-generation).
>>> 
>>> 
>>> Yes, if it knows the address of the other side of the
>>> connection. The attacker would have to be on link, or monitoring
>>> the traffic between the two hosts.  This make this attack much
>>> harder in practice for an off link attacker.  If on link, then
>>> there are so many better attacks.  Hence my comment of the
>>> problem being overstated.
>> 
>> It is trivial to know the IPv6 addresses involved for many
>> scenarios. e.g. BGP peer to BGP peer, secondary DNS to primary DNS,
>> SMTP server to SMTP server, etc.
> 
> That’s my point.  It’s trivial only if you know the addresses of both
> side of the connection.  It effects well known nodes.  It does not
> affect the vast majority of hosts on the Internet.  Hence, I think
> the text should accurately describe the risk.  I think the current
> text overstates the problem.  You could say something like you did
> above.

I've added text along these lines and rev'ed the I-D.

P.S.: Ready to ship now?

Thanks so much!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492