Re: [secdir] Secdir review: http://www.ietf.org/id/draft-jiang-a6-to-historic-00.txt

[Brian E Carpenter <[e-mail]>]

PHB,

Thanks for the review. See below.

On 2012-01-13 02:18, Phillip Hallam-Baker wrote:
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments
> just like any other last call comments.
> 
> Overview
> 
> A6 was a proposed replacement for AAAA records. A6 has not achieved the
> anticipated level of support or provided the anticipated benefits in
> practice. This draft moves A6 to historic, deprecating use of A6 records.
> 
> 
> Comments:
> 
> Removing A6 removes a potential source of inconsistency and thus improves
> consistency.
> 
> One possible consequence of this particular change is that information that
> was previously expressible via the A6 mechanism will no longer be visible.
> While this is not necessarily good or bad from a security standpoint it is
> an issue that should be mentioned in the Security Considerations.

Can do.

> 
> Another possible security impact is that it will not be possible to divide
> up administrative duties in the manner originally envisaged in the A6
> proposal. While it is far from clear that this division is useful (or
> achievable) it should probably be noted. In particular it will not be
> possible to achieve renumbering of whole domains by changing one record.

Indeed; that was the hope when A6 was designed, and in fact it's because
the 6renum WG is taking a new look at this area that we decided it was
time to clear the decks.

> 
> It is quite possible that some domains will continue to employ A6 domains
> as an administrative convenience, generating the corresponding AAAA records
> as required. This case needs more consideration from a security point of
> view. It would be useful to require that such records be ignored by
> applications and preferably be blocked from external view.

We already recommend "Removing A6 handling from all new or updated host stacks"
and we could add a recommendation for apps to ignore them.

Blocking visibility of RRs is generally not something the DNS community
likes, though.

     Brian