Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-22.txt
"Eric Vyncke (evyncke)" <evyncke@cisco.com> Mon, 08 February 2021 19:01 UTC
Return-Path: <evyncke@cisco.com>
X-Original-To: opsec@ietfa.amsl.com
Delivered-To: opsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BC0423A14CF for <opsec@ietfa.amsl.com>; Mon, 8 Feb 2021 11:01:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.62
X-Spam-Level:
X-Spam-Status: No, score=-9.62 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=I5devxO0; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=sKVgYwTZ
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZnC6VpCxM60a for <opsec@ietfa.amsl.com>; Mon, 8 Feb 2021 11:01:20 -0800 (PST)
Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id D2A1B3A14DB for <opsec@ietf.org>; Mon, 8 Feb 2021 11:01:19 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=4180; q=dns/txt; s=iport; t=1612810879; x=1614020479; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=DpRYRu/zgUKteN+0iBCaighUnPmosOF2TsIq+QgMU8s=; b=I5devxO0FjsXAMBv3uBuGYn5RsmDq3/sNQYMDS/IgPWogKXjhKZ74rgO Ju28alR9CSSP/pKpbFklVLkyy5ge+uWGflJ4SkVUW1qM4CxeCe7Q+TzIg U43F5XM1QzMXpCPXYNHHixljBLW9GWweCb/GrKSh8OTjpC4TUFpK0CWTL Y=;
IronPort-PHdr: 9a23:zunaNR/FORQZNf9uRHGN82YQeigqvan1NQcJ650hzqhDabmn44+7ZRaN5PhxghnOR4qIo/5Hiu+DtafmVCRA5Juaq3kNfdRKUANNksQZmQEsQavnQU32JfLndWo2ScJFUlI2/nynPw5SAsmtL1HXq2e5uDgVHBi3PAFpJ+PzT4jVicn/1+2795DJJQtSgz/oarJpJxLwpgLU5cQ=
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: A0B/DABriSFg/51dJa1igQmDIlEHdlo2MYRBg0gDjWwlA5kcglMDVAsBAQENAQEYCwoCBAEBhEsCF4FrAiU4EwIDAQELAQEFAQEBAgEGBHGFYQEMhXEBAQEEAQEhEQwBASwMCwQCAQgRAwECAwImAgICJQsUAQgIAgQTgyYBglUDLgEOpBgCiiV2gTKDBQEBBoE3Ag5BRII7GIISCYEOKoJ3hAiCUIN0JhuBQT+BOAwQglY+gl0BAQIBARWBRoMZNIIsgU8Ka2oETQQCFA45FidpKhwtkB+DJ6VLCoJ6iTaSTQMfgy6BM4kTlS6UMosrlksCAgICBAUCDgEBBoFtI4FXcBUaISoBgj4JRxcCDZIShRSFRXQ3AgYBCQEBAwl8ixwBAQ
X-IronPort-AV: E=Sophos;i="5.81,163,1610409600"; d="scan'208";a="833641909"
Received: from rcdn-core-6.cisco.com ([173.37.93.157]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 08 Feb 2021 19:01:18 +0000
Received: from XCH-RCD-005.cisco.com (xch-rcd-005.cisco.com [173.37.102.15]) by rcdn-core-6.cisco.com (8.15.2/8.15.2) with ESMTPS id 118J1IEn000480 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for <opsec@ietf.org>; Mon, 8 Feb 2021 19:01:18 GMT
Received: from xfe-rcd-003.cisco.com (173.37.227.251) by XCH-RCD-005.cisco.com (173.37.102.15) with Microsoft SMTP Server (TLS) id 15.0.1497.2; Mon, 8 Feb 2021 13:01:18 -0600
Received: from xhs-rtp-002.cisco.com (64.101.210.229) by xfe-rcd-003.cisco.com (173.37.227.251) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.792.3; Mon, 8 Feb 2021 13:01:18 -0600
Received: from NAM04-CO1-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Mon, 8 Feb 2021 14:01:17 -0500
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=CZdka1voWOHUvtp61pKQHq7+ai+NS5jq7eUtECsAxzvIKkCDDulX39vEu2F6IVsxB6w/ZEah0rIzbGCP0VhK8S7hSB8uCokwvS/9p6SQh78ZBmhHcQMBZkQ0voFjZQ2+rkOqIJ7uWb+UmwKZOf0NH+/jVRC9tPJZumYUFUfyB9B5AWBBOW9QvM44qEM1+3iPE2qqz2p9/MZ+dXo9T9A0bTSoGG4kpLiwEPnvKFXzsGP3bLA4OJcSAiKqzMoENUWVbTi5hb6GRE9Ix3RghX4k3otstHuI+qoeje7dEI+VudZV2y8DzK0FYuMbBFFihPf8Q7VTiTUysk12Jw2rMf62/w==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DpRYRu/zgUKteN+0iBCaighUnPmosOF2TsIq+QgMU8s=; b=OAELacUlikhlR5pbd1V6pJOgmPuxZbHjkIA4RRsp4tyjxhN2U2FB4UxMMK0EnF639zUxt2hQkZz0+6gEMjsD9lPj+o3h1h9OHcDctCxWoDma8osUMGLpYXZYfI1LJz1UIZ195FjPm/jjB1RVtZEqiYocrtSA0KCHvUyysAE3PXHOu+gzZ6EkK0o8do3uYfSOo8bzN9en62jp0sjDeBtlcC1RNVusqjTJvIpAakPEieSKNFppzr0BXaNdz32IF/9oK1TDZt1UbKgx2C+ooHsZ/DI7aAGwpjfPAZzBqodnDgKVubrTLm8HUMiWMfnF6+QrOI7kCIweHZrsY14e3rEDog==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=DpRYRu/zgUKteN+0iBCaighUnPmosOF2TsIq+QgMU8s=; b=sKVgYwTZe2/KzG5EdspeBP0GGn5EbW34bfM1z85mQb4r1IFod/pDQzSyEuBtPcMNycCWAJxXV+LsINOYOw+86iUKWP0TJm6lFD6KICXCpDrhZZpwqW+B44vt/imO5eVJd3tuzeJAUXNRuMr+nu0d2d0CuQ+6mWUHyhHVrjywV+0=
Received: from PH0PR11MB4966.namprd11.prod.outlook.com (2603:10b6:510:42::21) by PH0PR11MB4887.namprd11.prod.outlook.com (2603:10b6:510:30::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3825.27; Mon, 8 Feb 2021 19:01:16 +0000
Received: from PH0PR11MB4966.namprd11.prod.outlook.com ([fe80::7d4c:6b05:89aa:85b]) by PH0PR11MB4966.namprd11.prod.outlook.com ([fe80::7d4c:6b05:89aa:85b%3]) with mapi id 15.20.3825.030; Mon, 8 Feb 2021 19:01:16 +0000
From: "Eric Vyncke (evyncke)" <evyncke@cisco.com>
To: "opsec@ietf.org" <opsec@ietf.org>
Thread-Topic: [OPSEC] I-D Action: draft-ietf-opsec-v6-22.txt
Thread-Index: AQHW/kwdxaqH4WxAjE62KYpOPsc7aapOrbeA
Date: Mon, 08 Feb 2021 19:01:16 +0000
Message-ID: <34DE1A4B-D1CF-4553-96B1-EA45C1886021@cisco.com>
References: <161281052752.3647.9834482990535014406@ietfa.amsl.com>
In-Reply-To: <161281052752.3647.9834482990535014406@ietfa.amsl.com>
Accept-Language: fr-BE, en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
user-agent: Microsoft-MacOutlook/16.45.21011103
authentication-results: ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=cisco.com;
x-originating-ip: [2001:420:c0c1:36:100e:6f1d:a399:c098]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: 7ef0e890-3c9e-48da-a190-08d8cc63e9a3
x-ms-traffictypediagnostic: PH0PR11MB4887:
x-microsoft-antispam-prvs: <PH0PR11MB48874C4D8656D4D44C0F6979A98F9@PH0PR11MB4887.namprd11.prod.outlook.com>
x-ms-oob-tlc-oobclassifiers: OLM:4303;
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: 81KZclpRSE88D9ZAlXFOttI7tfYKjGGh4Fqe1k/NoSr5vCjh3HF2xIuBaSabhBZXREwOHt0SZpVVqBL5aoid4/XtHl5QtXMwE7aORDECJByi4XQYZlSx8aC6N/w+9sZmTvXgYp+JDJ2ov4CUnh6oXpHjReoH8O+xvoslDxHHypeNpQc5baNNKNnmPGn27W55A/EImjd8kUFVgpiEVFrf/21yAOkSHmO2hVdfb9kiEpW7mYCwnyjgjNv3rvIhgOIJbjAumBEFRkwmCBDSfJBleeRgaDrvkK9qyEffhUQb/HrZwpyAxeS/6YUPHTVAMYScGVgTRBWT6/pqLrN1qqIjOubvpeMWKA7Vd4PMdakbFKkOWpg2+g2Tanu4By40o46Q5bez50g+nBAEKhcDYH0I0rXKoS3RiNpxGp9adeVIJdKLuUMode1Iru2c7619iWcqze5WLdkrxpMB6HnDi7GUArAQEv59A8iCftfrSMYyZCC9FeNGbLa+SySV9bDRpCt7EnTLVTaMKKtL6afxmMmtsXSuZjmXiSc1rX5QZwYrwW/ZmpfmnfQA1Czw9BhNxCg3SpSW1C5LT8+hsx/TG1KYvH1VbsS2DgzXhSNKXjuxrKZhdlpeL4A+LHhBAaK2mb5GXg14NSc8b6RxcLPhiKtHIQ==
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PH0PR11MB4966.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(376002)(396003)(39860400002)(346002)(136003)(36756003)(478600001)(6506007)(6512007)(66946007)(71200400001)(91956017)(6916009)(8676002)(33656002)(8936002)(6486002)(186003)(2906002)(86362001)(966005)(66556008)(83380400001)(64756008)(66446008)(76116006)(316002)(2616005)(66476007)(66574015)(5660300002)(53546011)(45980500001); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata: xq0Bzv56tKvrUC4tCi1GsfgD47HxcuAcLC61UWNQkaoHDq/iphG1XGbkfcpBCHDWUHR998T/kY5D57ygbsxbAbFhBZEgmARDnTy4XMzSaDDlQPp/nVHFbUlvHosd3rw5KML/qMRRVF3MLoZbkO29U1eqkmEjtRwFZumSXihORQJl5GZ6Xza+X7R6HnTGcvk6tpbq/KokC1VAG2Jp0Xjmy2HmfnGkSEj8T1RwR3qHkWRaXIW3Xtxm64nbTkO0jAnpFjS/l69lkzr6hkFIJMa3/jA7ZV+2H+qSZYJS/HNJJk/VepkbyDUM2LpRmOJUKDklxCxg0O+QAfFbnUMwu2q8QMd+ht/qOfZIkiMpcnvq36Wei5NCAasqEbXf3yyEVMV405D/KWXH5pVk1/MsmkrKVJkTg+1+WyA+gJ3CAM95L76xMhhDnGPbjPRc5Zk3eiEgOCbcEItlEaIyfuCKDFMG+VsyaviWkRpd5Z22AtMQ67+nBG9JD/GiflYYLBz3Hd5bMlwZ7eqTOaFSByaWw3uU7a+rSPZNpeWC2bn8yHri3ZDGtxzrt/HFajsKI1IUduf8e+olAZhLpaLqas+kZr61q9W12gwtep+ynIE4lKgS7eG0gzPrplYbkqTsHBmOkXJd/8qLajIDvSbiVHUhRb4kBZHqvyxrKhdOtvH60th4Gg2dmUCbih+yu6CDSILwFUHTzgSVyvDlnomzr4KnKgN6hWuuumfgwZOs81sVYPUJPe93RgaS4uKTq6SKpvKSXxFAPmVEsKIXSHxcfkDNLRqLz2eGBNHRoNHfWN9KCogC/LVThqEDI0iDK5K4TaboAgasRDd6TSmh4XpF5STZ/rEQkUPBrp51Boq2wdypx9y+yj+S4yZcifZ3eOtDoVaIae71RcdpZUZ3LZPxOhSukSt3zVtjeSwvObCw83IpbjgwBMuRPLC6wZp7HAT4kiP/hRCPGvOn8Qb1OoGLAdG1g39jh7yf4IWFK5uxHyDONVfFiwO5hRJmZboaSo8yJbGMjTY8lQTQXO8wu6RXANYPnuEG3aLKlCdjujV/GizJG9/aNv9+ATvl3LAoiAqw0DrKPp3OLOwG9OsnLy5IdG7G82DuobOKZUIuDMcF0RYN9RwDnoVA41Qy7nqjOrTyyKULPVhGnDvVIN3b2C8MTmmZbsYnvDQxzExo+N3cQdfMn/Oi42uxOnp1brTFwKQaNCLEcOmZxb2Y9ioasY3/Dyp3A97D/xo/pmwDL2FiIzDSu1xyrTBLURe+jgmTXG9uqXb3sFU8SVojX2qrW/hS9xCMNSIaUxQ8x6bzpfFGUV9rkgfDG8sl1M8ZC7l3BU52RXETvzZy2Kh2vUJMKSq93pgI++3orkWRSI4Et6p1KDBDLpv6wyva5MJctR/PotthOm7Oidbg
x-ms-exchange-transport-forked: True
Content-Type: text/plain; charset="utf-8"
Content-ID: <B914CF29136ABF41B62910E4B12A9819@namprd11.prod.outlook.com>
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4966.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 7ef0e890-3c9e-48da-a190-08d8cc63e9a3
X-MS-Exchange-CrossTenant-originalarrivaltime: 08 Feb 2021 19:01:16.5025 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: yWFc3g5qKdG4RdNQ6ShFZJPMwTfDj6eyy+YoZbcQUCrbHRGvQFcvFSZCO6RH8xfy+PLGpR5p1/4XFgh3Av8vig==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB4887
X-OriginatorOrg: cisco.com
X-Outbound-SMTP-Client: 173.37.102.15, xch-rcd-005.cisco.com
X-Outbound-Node: rcdn-core-6.cisco.com
Archived-At: <https://mailarchive.ietf.org/arch/msg/opsec/_voAIIvVoYKe-EqAQ5nMZO9US9M>
Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-22.txt
X-BeenThere: opsec@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: opsec wg mailing list <opsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/opsec>, <mailto:opsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/opsec/>
List-Post: <mailto:opsec@ietf.org>
List-Help: <mailto:opsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/opsec>, <mailto:opsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Feb 2021 19:01:22 -0000
This new revision (long due...) addresses the comments received from the OPS directorate (Tim Chown and Don Smith) + Mohamed Boucadair. The authors still need to address the IETF Last Call comments from the following directorates: IoT (Ted Lemon), Routing (Acee Lindem), Security (Linda Dunbar), and GEN (Erik Kline). Stay tuned but do not hold your breath __ -éric -----Original Message----- From: OPSEC <opsec-bounces@ietf.org> on behalf of "internet-drafts@ietf.org" <internet-drafts@ietf.org> Reply-To: "opsec@ietf.org" <opsec@ietf.org> Date: Monday, 8 February 2021 at 19:56 To: "i-d-announce@ietf.org" <i-d-announce@ietf.org> Cc: "opsec@ietf.org" <opsec@ietf.org> Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-22.txt A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF. Title : Operational Security Considerations for IPv6 Networks Authors : Eric Vyncke Kiran Kumar Merike Kaeo Enno Rey Filename : draft-ietf-opsec-v6-22.txt Pages : 55 Date : 2021-02-08 Abstract: Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol, but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in several types of network (enterprises, service providers and residential users) and proposes technical and procedural mitigation techniques. The residential users case assumes a managed ISP CPE device. Some very specific places of a network such as the Internet of Things and unmanaged home networks are not discussed in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsec-v6-22 https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-22 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-22 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec
- [OPSEC] I-D Action: draft-ietf-opsec-v6-22.txt internet-drafts
- Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-22.txt Eric Vyncke (evyncke)
- Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-22.txt Fernando Gont