Re: Stephen Farrell's Discuss on draft-ietf-6man-stable-privacy-addresses-16: (with DISCUSS and COMMENT)

[Eliot Lear <[e-mail]>]

Fernando,

On 1/21/14, 8:08 PM, Fernando Gont wrote:
>
>> If keeping it, I'd say give the example and then add a
>> security consideration that that interface might be
>> vulnerable (e.g. 'cat /proc/net/eth0/rfcxxx-secret'
> How about rather noting that the secret key should only be accessible by
> the system administrator? (i.e., non-RFC2119 recommend that implementers
> do the right thing :-) )
>

I agree with the requirement but I think Stephen raises an important
point, which is that it should be highlighted that the information is
sensitive.  As such, implementations should constrain access to the
information, to the extent practicable.  Furthermore, I understood
Stephen's point also to be that the private key information should not
be used for any other purpose.

But maybe I misunderstood.

Eliot