Re: you have running code ... I-D Action: draft-ietf-6man-ipv6only-flag-03.txt

[Nick Hilliard <[e-mail]>]

Alexandre Petrescu wrote on 05/11/2018 11:49:
> Well there is the Secure Neighbor Discovery protocol (SeND).  With it 
> one can claim the link to be secure if IPv6-Only and insecure if IPv4 is 
> present.

well, there isn't because the presence or absence of SEND won't stop 
anyone from using ipv4, particularly if the use case is malicious.

> Simpler but less strong than SeND, there can be mechanisms to ensure a 
> certain level of security, about the MAC address in the L2 header of the 
> RA.

"secure" mac addresses can only be deployed if the network supports l2 
filtering at the user edge, in which case the ipv6only flag is largely 
pointless because you can make ipv4 go away with the same style of ACL, 
with the added benefit that it will actually make your network ipv6-only.

Nick