Re: [rtcweb] Security implications of host candidates

Justin Uberti <juberti@google.com> Tue, 17 July 2018 16:04 UTC

Return-Path: <juberti@google.com>
X-Original-To: rtcweb@ietfa.amsl.com
Delivered-To: rtcweb@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BB2FD130DE4 for <rtcweb@ietfa.amsl.com>; Tue, 17 Jul 2018 09:04:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.861
X-Spam-Level:
X-Spam-Status: No, score=-15.861 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DC_PNG_UNO_LARGO=0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, ENV_AND_HDR_SPF_MATCH=-0.5, HTML_IMAGE_ONLY_16=1.092, HTML_IMAGE_RATIO_04=0.556, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, T_DKIMWL_WL_MED=-0.01, USER_IN_DEF_DKIM_WL=-7.5, USER_IN_DEF_SPF_WL=-7.5] autolearn=no autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=google.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HhJ1Uz1hq6i1 for <rtcweb@ietfa.amsl.com>; Tue, 17 Jul 2018 09:04:56 -0700 (PDT)
Received: from mail-io0-x22a.google.com (mail-io0-x22a.google.com [IPv6:2607:f8b0:4001:c06::22a]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id DC3DC120049 for <rtcweb@ietf.org>; Tue, 17 Jul 2018 09:04:55 -0700 (PDT)
Received: by mail-io0-x22a.google.com with SMTP id g11-v6so1431789ioq.9 for <rtcweb@ietf.org>; Tue, 17 Jul 2018 09:04:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=Bsdqu73fQk3TNYEACjdk9ULKV5zVOa5y/A6T17+2ggk=; b=iV/Ix7OxGZj6pwQwCxrpVgaEdYNmebKzUUajhHOJbGc5k4zY3W/QjLVgBiqbGmpEVN n8gEUPpkA94PyZjqodr7hD5pL9opL/UnAv/Lla1+bIIsPi7bZAOZ80D6sWloKme7R1zS VBijorxDTO8JM031Z07KhEJ2bhC4Nz5HU1ap5eK4jpV1A5coL+UMh/eNJsLaKPeBB9Eu hSMlz+fESX102Qq2K1IUXMl/E8b2bNZQNCZOPPM6TyMPgYSTDzSz5ip1scK3YUV4ZWky IC4WSqGNHE07lLJbOnC5pH3bEs2ar3VasWNoVtwdGT6dTS/gGFUk3CGbu1ODxJeJu40w DtcA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=Bsdqu73fQk3TNYEACjdk9ULKV5zVOa5y/A6T17+2ggk=; b=j3NK8ig4eAJnOW9GbDCSYOA3EcXChQ8trT+2FhZVBPogfKG2KGwiGyaN0v8uKNSCeI /5O+yEW0PpemtRH11ab0+i6ujtKGZTmG3KaHXNvy4p0gr4XuIWmrecNhpbwgPwgmhW/M cEWiQEZ9J9emzNkQ0LUXPhR+DP4VdN7N7DzVQjyt/hZpi599KXJ0i4V8e5aS7U786bCt fh1/6b0g5YoH55xW9y9IOyy4h/OCBbMI7Rmx65llgqGPoE2xULPgLK2uXI+WIBKq/bL3 6q/PFJf0cZEqIaeC7VQvvDcMOLxDz6dgRJ7wrm/DGTtC7A+rYGtfWBo2VPUfmpO8XaAm yCng==
X-Gm-Message-State: AOUpUlE1OvyAei/saVS7ufNILHUm7Jgm/S7CQuqG/2SDKwOOhRpvA2CR jI62s7LXGN4Pxv98yoh7Y3G0cmboPux+1UkGsOnQ0uo54p0=
X-Google-Smtp-Source: AA+uWPyE1wyQtsmADMq5RqT1sUPT53q/eAX9c9JXKQVTZT74heGwnxfXnBKAk8wzWPGGDjWRa7L3BotHv/kLLywguF4=
X-Received: by 2002:a6b:e913:: with SMTP id u19-v6mr2070667iof.38.1531843494371; Tue, 17 Jul 2018 09:04:54 -0700 (PDT)
MIME-Version: 1.0
References: <CAOJ7v-1t_BDEEHmA4eqiS9ksYOOyHUz9LFLhQxs8FhjTdswP5w@mail.gmail.com> <CAOJ7v-3moUqwgxkz1Fek4vy-XV+WpDaO-PsQZEw4ougoCHjLww@mail.gmail.com> <CANN+akZ=Ebw41mA2wEX7-4u6q5WcZbFtM=VMLX4nDK39S=QGOQ@mail.gmail.com> <CAOJ7v-3X2Sj8Yid+i0=xadyH_Hmf4pMOF_iuOV+56Ty8HNnJuw@mail.gmail.com> <0ED74BE5-AC02-44C5-80E1-18532BD3D1FF@westhawk.co.uk> <CAOJ7v-0TGqvp=MUmeEUjYZTcvV37qbYSTV0pFMoi1J0CJQ7Q4A@mail.gmail.com> <CABkgnnXBTC5TERquJPO4dgiAKz037Cm0Omw4YrobtCW=wmGPyQ@mail.gmail.com> <CAOJ7v-0yzvu9POvR4Auokykqc63eju6_CveAzyVpcSd1kkK6Nw@mail.gmail.com> <CABkgnnXL6sdCDt=hjX+7KbP+xYm9jCmgjJNy4CvPPna_0oin=g@mail.gmail.com> <CAOJ7v-33ODGTsmbHEp_U7UdROvuKR7O7bne2_0tX6ivVf-+C5A@mail.gmail.com> <CABkgnnWJM4CE2ZLHYOOd=VYUj7kn5wFMAbeGB1HRyp++nvbPoQ@mail.gmail.com> <CAOJ7v-2WGyHSbSJwgbVVHLs-GO71rMLS2+OTetNyMhb0TM3ZcA@mail.gmail.com> <54EB6378-5DA2-4125-A4F4-84151D0E4F04@apple.com> <CAOJ7v-2dw1coDTpovTrKa__Oak7Jjn5EYgvWtByaRYmxfDDtXw@mail.gmail.com> <1d60feec-3a36-2deb-e4a7-703fb7144ed1@alvestrand.no> <68bb5744-d9f2-462c-446d-ae47f2f27e5e@gmail.com> <CAOJ7v-3CF5hXxOGkufzdP6VqrvjHW6BhnB1mjVnHjwv8pcP7KA@mail.gmail.com> <4712E24B-907F-40B3-A7E7-8FCBF46F6BC4@mozilla.com>
In-Reply-To: <4712E24B-907F-40B3-A7E7-8FCBF46F6BC4@mozilla.com>
From: Justin Uberti <juberti@google.com>
Date: Tue, 17 Jul 2018 09:04:42 -0700
Message-ID: <CAOJ7v-0o0mF+181c6X+9P2kd4NtZUEJcYnRcdt4F7_1Bzh6GsA@mail.gmail.com>
To: Nils Ohlmeier <nohlmeier@mozilla.com>
Cc: Lennart Grahl <lennart.grahl@gmail.com>, RTCWeb IETF <rtcweb@ietf.org>
Content-Type: multipart/related; boundary="00000000000056227e0571341bad"
Archived-At: <https://mailarchive.ietf.org/arch/msg/rtcweb/MqKyJF5Ev5oNG2DdghubyI4VPGE>
Subject: Re: [rtcweb] Security implications of host candidates
X-BeenThere: rtcweb@ietf.org
X-Mailman-Version: 2.1.27
Precedence: list
List-Id: Real-Time Communication in WEB-browsers working group list <rtcweb.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/rtcweb/>
List-Post: <mailto:rtcweb@ietf.org>
List-Help: <mailto:rtcweb-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/rtcweb>, <mailto:rtcweb-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Jul 2018 16:04:58 -0000

Private IPv6 would be one behind NAT, e.g. NAT64. The IPv6 is not exposed
to the outside world.

[image: image.png]


On Tue, Jul 17, 2018 at 7:33 AM Nils Ohlmeier <nohlmeier@mozilla.com> wrote:

>
> On Jul 11, 2018, at 19:01, Justin Uberti <
> juberti=40google.com@dmarc.ietf.org> wrote:
>
> Thanks for the suggestions on intermediate modes. I think we're converging
> on the following potential replacements for Mode 2:
> 2b) IPv4 mDNS + RFC 4941 IPv6
> 2d) mDNS of any private IPv4/IPv6  + any public v4/v6 (as determined via
> STUN query)
>
>
> Can you please explain what do you consider as a private IPv6 vs a public
> IPv6 address?
>
> Thanks
>   Nils Ohlmeier
>
>