Re: [Mip6] WGLC: draft-ietf-mip6-bootstrapping-split-01 - Comments

[Francis Dupont <[e-mail]>]

 In your previous mail you wrote:

   > => IMHO an IKEv2 implementation should perform a proxy DAD when it
   > allocates an address before returning it as it should provide
   > a proxy NDP service (i.e., reply to NS by not-overriding NA).
   > Both should be configurable with by default being on.
   
   okay, but I dont think we should mandate the IKEv2 implementation
   to do proxy DAD.
   
=> we (as the MIP6 WG) should not but we (as the IETF) should.

   >    the authorization check is required. cant be skipped.
   > 
   > => show us where this authorization for the address is required
   > or even mentioned in RFC 2136, PLEASE!
   
   in the security considerations section we have the following.
   
=> this is fully irrelevant as this is *not* from the RFC 2136.

       This
       choice was motivated by a concern for preventing redirection-based
       flooding attacks (see draft-ietf-mip6-ro-sec [19] for more
       information about redirection-based flooding attacks and the role
       preventing them played in the design of Mobile IPv6 route
       optimization security). Exactly as for route optimization, it is
       possible for a node that is the legitimate owner of a DNS FQDN -
       in the sense that it has a security association with the DNS
       server allowing it to perform dynamic DNS update of its FQDN - to
       bind its FQDN to the address of a victim, then redirect large
       volumes of traffic at the victim. The attack may be propagated
       without the owner's knowledge, for example, if the node is
       compromised by malware, or it may be intentional if the node
       itself is the attacker.
   
   if RFC 2136 ignored this, I cant help it.
   
=> the RFC 2136 ignored this and it is in its scope, not in the scope
of the MIP6 WG.

Regards

[e-mail]

_______________________________________________
Mip6 mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/mip6