Re: [OPSEC] New Version Notification for draft-yourtchenko-opsec-humansafe-ipv6-00.txt

[Fernando Gont <[e-mail]>]

Hi, Andrew,

On 03/06/2012 07:32 AM, Andrew Yourtchenko wrote:
>> I think this one is somewhat incorrect: What's usually deemed as hard to
>> manage is temporary addresses (RFC 4941), rather than the fact that the
>> identifiers are random (see e.g.,
>> <http://tools.ietf.org/id/draft-gont-6man-managing-slaac-policy-00.txt>).
> 
> No, in this case I'm talking about permanently assigned addresses. It's
> just that telling the full IPv6 address over the phone or remembering it
> is a chore.

It wasn't clear to me that you were referring to this problem.



> Example: 2001:db8:d923:297a:2068:d95d:cff5:308a. Make an experiment and
> measure how much it takes to get this address over to someone over the
> phone, without errors. That's the type of problem I had in mind.

I know of quite a few folks that have already established the rule that
"you don't tell IPv6 addresses over the phone"


>> * Section 5 states:
>>   The idea is to exploit the randomness property of the encryption
>>   function output.  The interface identifier, used within the IPv6
>>   address of the host, would be derived from the 64-bit data
>>   corresponding to hostname, encrypted with a site-wide "secret".
>>
>> How would you distribute the secret.
> 
> USB stick, for example. Or write it on the wall in the ops room :-)

BTW, what are the types of systems that you have in mind for using this?
Host? Servers? Routers? All of them?



> I probably should have not named it a "secret" - the idea was to have it
> secret enough so that a random script kiddie does not know it, yet it
> can be easily known by the staff. Any suggestions on how I should rename
> it so there's less confusion ?

Well, as far as the attacker is concerned, the "secret" is secret. So
the term is okay. But I guess it should be more clear to whom the
"secret" is secret, and how you plan to distribute it.


>> That aside: have you read
>> <http://tools.ietf.org/id/draft-gont-6man-stable-privacy-addresses-00.txt>.
>>
>> It solves the scanning problem and the management problem, with no need
>> to distribute secrets.
> 
> It's nice, however it requires changes to host OSes.

Well, yes... but that's what you need to do to fix the underlying
problem of vulnerability to scanning...

Thanks,
-- 
Fernando Gont
SI6 Networks
e-mail: [e-mail]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492