Re: [OPSEC] Opsdir early review of draft-ietf-opsec-v6-13

["Eric Vyncke (evyncke)" <[e-mail]>]

Hello Donald,

As for Tim Chown's review, here is my belated reply...

Look for EV>

Thank you for the review

-éric


-----Original Message-----
From: "Smith, Donald" <[e-mail]>
Date: Monday, 2 July 2018 at 22:14
To: Tim Chown <[e-mail]>, "[e-mail]" <[e-mail]>
Cc: "[e-mail]" <[e-mail]>, "[e-mail]" <[e-mail]>
Subject: Re: [OPSEC] Opsdir early review of draft-ietf-opsec-v6-13

    Routing security talks exclusively to OSFPv3 which isn't in common use externally today, BGP would be a better choice.

EV> I made the reference to RFC 7454 more prominent in the text

    2.1.1 This:
    There are many scanning
       techniques and more to come possible, hence, operators should never
       relly on the 'impossible to find because my address is random'
       paradigm.

    Should probably be this:
    There are many scanning techniques and possibly more to come, hence, operators should never rely on the 'impossible to find because my address is random' paradigm.

    Or adding Tom's suggestion:
    There are many scanning techniques and possibly more to come, hence, operators should never rely on the 'security by obscurity' paradigm.

EV> indeed, the text has changed following Tim's suggestion

    Maybe it doesn't belong there but this appears to be a potential new smurf amplification vector.

    "Another way works only for local network, it consists in sending a
       ICMP ECHO_REQUEST to the link-local multicast address ff02::1 which
       is all IPv6 nodes on the network.  All nodes should reply to this
       ECHO_REQUEST per [RFC4443]."

EV> except that this is local only (packets to ff02::1 will not be forwarded by an IP router). SO, the attack is local only (but could be a real annoyance in same settings).

    But maybe that belongs in 4443 or some other draft?



    I feel some mention of anycast used for DDoS Reflection and Amplification (RA) should be included (again might be out of scope)?

EV> I agree that RFC 4443 did not take this amplification attack into consideration. At least nowadays, large layer-2 (notably wifi) have disabled the link-local multicast. Added a new section 2.3.6 on this issue.



    Metric System < +000 > -000
    Extra People's Terribly Good Meals Kept mY uNCLE    Ned   Purring For     Ages
    Exa   Peta        Tera     Giga   Mega  Kilo milli Micro(u) Nano Pico    Femto Atto
    [e-mail]