Re: Stephen Farrell's Discuss on draft-ietf-6man-stable-privacy-addresses-16: (with DISCUSS and COMMENT)

[Fernando Gont <[e-mail]>]

On 01/25/2014 05:39 PM, Brian E Carpenter wrote:
> On 24/01/2014 06:22, Fernando Gont wrote:
> ...
>> "Since the privacy of this system relies on the secrecy of the
>> secret_key parameter, implementations should constraint access to it to
>> the extent practicable (e.g., require superuser privileges to access
>> it). Furthermore, in order to prevent leakages of the secret_key, this
>> parameter should not be used for any other purposes than being a
>> parameter to the scheme specified in this document"
> 
> Nobody could conceivably object to that, but I do wonder whether the
> statement "Secret keys should be kept secret" doesn't belong in a much
> more generic document than this one. Actually a BCP on pitfalls surrounding
> secret keys and how to protect them would be very valuable, but doesn't
> belong in this WG.

I agree with you.

I'd say I would have probably objected against adding this (with the
argument "well, this should be obvious to everyone"). But then I recall
having a conversation with a folk working on TCP SEQ randomization
(using a similar scheme) for a popular OS, and apparently they were
employing a constant secret key for all their systems. Hence, "sometimes
it's not bad to clarify what you might deem as obvious".

P.S.: And while at times it's easy to blame the guy doing the
implementation, the truth is that at times the same folk is working on
so much stuff that he kind of blindly implements whatever is in the
spec, without much analysis. So... better fail on the safe side.

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492