Re: Chairs Review on <draft-ietf-6man-predictable-fragment-id-02>
Fernando Gont <fgont@si6networks.com> Fri, 29 May 2015 08:36 UTC
Return-Path: <fgont@si6networks.com>
X-Original-To: ipv6@ietfa.amsl.com
Delivered-To: ipv6@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D0E401A86EB for <ipv6@ietfa.amsl.com>; Fri, 29 May 2015 01:36:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.902
X-Spam-Level:
X-Spam-Status: No, score=-1.902 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id g06Kn78WnOVW for <ipv6@ietfa.amsl.com>; Fri, 29 May 2015 01:36:15 -0700 (PDT)
Received: from web01.jbserver.net (web01.jbserver.net [IPv6:2a00:8240:6:a::1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B68321A01FC for <ipv6@ietf.org>; Fri, 29 May 2015 01:36:15 -0700 (PDT)
Received: from cl-1071.udi-01.br.sixxs.net ([2001:1291:200:42e::2]) by web01.jbserver.net with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.85) (envelope-from <fgont@si6networks.com>) id 1YyFm0-0005pP-Vu; Fri, 29 May 2015 10:36:13 +0200
Message-ID: <55682029.2040609@si6networks.com>
Date: Fri, 29 May 2015 05:15:37 -0300
From: Fernando Gont <fgont@si6networks.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: Bob Hinden <bob.hinden@gmail.com>
Subject: Re: Chairs Review on <draft-ietf-6man-predictable-fragment-id-02>
References: <6277AC1A-F1ED-4BE9-984E-C424BC9A5136@gmail.com> <54FCDECD.2040609@si6networks.com> <75C9B430-7D39-4466-AB17-0F3553EC6EB4@gmail.com> <555AE0AF.5050601@si6networks.com> <F1464F80-172F-4F83-B10B-F9738B2B1AB3@gmail.com>
In-Reply-To: <F1464F80-172F-4F83-B10B-F9738B2B1AB3@gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8bit
Archived-At: <http://mailarchive.ietf.org/arch/msg/ipv6/iscP5BCSfD9dLLCc5JaXqtyp9gM>
Cc: IPv6 List <ipv6@ietf.org>
X-BeenThere: ipv6@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "IPv6 Maintenance Working Group \(6man\)" <ipv6.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipv6>, <mailto:ipv6-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipv6/>
List-Post: <mailto:ipv6@ietf.org>
List-Help: <mailto:ipv6-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipv6>, <mailto:ipv6-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 29 May 2015 08:36:18 -0000
Hi, Bob, On 05/19/2015 05:40 AM, Bob Hinden wrote: >>>>> In Section 2 "Security Implications of Predictable Fragment >>>>> Identification valuesâ. The problems listed seem to us to >>>>> be overstated. As the draft notes later, the issue with >>>>> predictable fragment IDs in IPv6 is only an issue for IPv6 >>>>> packets with the fragment header. >>>> >>>> Yes, but you can trigger fragmentation for any traffic flow >>>> (see draft-ietf-6man-deprecate-atomfrag-generation). >>> >>> >>> Yes, if it knows the address of the other side of the >>> connection. The attacker would have to be on link, or monitoring >>> the traffic between the two hosts. This make this attack much >>> harder in practice for an off link attacker. If on link, then >>> there are so many better attacks. Hence my comment of the >>> problem being overstated. >> >> It is trivial to know the IPv6 addresses involved for many >> scenarios. e.g. BGP peer to BGP peer, secondary DNS to primary DNS, >> SMTP server to SMTP server, etc. > > That’s my point. It’s trivial only if you know the addresses of both > side of the connection. It effects well known nodes. It does not > affect the vast majority of hosts on the Internet. Hence, I think > the text should accurately describe the risk. I think the current > text overstates the problem. You could say something like you did > above. I've added text along these lines and rev'ed the I-D. P.S.: Ready to ship now? Thanks so much! Cheers, -- Fernando Gont SI6 Networks e-mail: fgont@si6networks.com PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492
- Chairs Review on <draft-ietf-6man-predictable-fra… Bob Hinden
- Re: Chairs Review on <draft-ietf-6man-predictable… Fernando Gont
- Re: Chairs Review on <draft-ietf-6man-predictable… Bob Hinden
- Re: Chairs Review on <draft-ietf-6man-predictable… Fernando Gont
- Re: Chairs Review on <draft-ietf-6man-predictable… Bob Hinden
- Re: Chairs Review on <draft-ietf-6man-predictable… Fernando Gont
- Re: Chairs Review on <draft-ietf-6man-predictable… Bob Hinden
- Re: Chairs Review on <draft-ietf-6man-predictable… Fernando Gont