Re: [secdir] SECDIR review of draft-ietf-v6ops-ipv6-discard-prefix-02

Joel jaeggli <joelja@bogus.com> Sat, 21 January 2012 16:14 UTC

Return-Path: <joelja@bogus.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0FFAB21F84A3; Sat, 21 Jan 2012 08:14:54 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -102.599
X-Spam-Level:
X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8tpfgEI7G1An; Sat, 21 Jan 2012 08:14:53 -0800 (PST)
Received: from nagasaki.bogus.com (nagasaki.bogus.com [IPv6:2001:418:1::81]) by ietfa.amsl.com (Postfix) with ESMTP id 8B14B21F84A5; Sat, 21 Jan 2012 08:14:53 -0800 (PST)
Received: from Joels-MacBook-Pro.local (user-64-9-235-240.googlewifi.com [64.9.235.240]) (authenticated bits=0) by nagasaki.bogus.com (8.14.4/8.14.4) with ESMTP id q0LGEndp066271 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT); Sat, 21 Jan 2012 16:14:49 GMT (envelope-from joelja@bogus.com)
Message-ID: <4F1AE479.2010704@bogus.com>
Date: Sat, 21 Jan 2012 08:14:49 -0800
From: Joel jaeggli <joelja@bogus.com>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:8.0) Gecko/20111105 Thunderbird/8.0
MIME-Version: 1.0
To: Chris Lonvick <clonvick@cisco.com>
References: <Pine.GSO.4.63.1201201036400.24206@sjc-cde-021.cisco.com>
In-Reply-To: <Pine.GSO.4.63.1201201036400.24206@sjc-cde-021.cisco.com>
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.2.7 (nagasaki.bogus.com [147.28.0.81]); Sat, 21 Jan 2012 16:14:51 +0000 (UTC)
Cc: draft-ietf-v6ops-ipv6-discard-prefix.all@tools.ietf.org, iesg@ietf.org, secdir@ietf.org
Subject: Re: [secdir] SECDIR review of draft-ietf-v6ops-ipv6-discard-prefix-02
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 21 Jan 2012 16:14:54 -0000

Not a big fan of the use of "however" I think  this can be addressed at
minimum by auth48.

On 1/20/12 10:47 , Chris Lonvick wrote:
> Hi,
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> Overall, the document is very straightforward and the Security
> Considerations section is appropriate for the content.
> 
> I do have one nit to pass along.  I think that a paragraph break is in
> the wrong place in the Introduction.
> 
> Current in Introduction:
> (end of first paragraph)
>    manner which is efficient, scalable and straightforward to implement.
>    For IPv4, some networks configure RTBH installations using [RFC1918]
>    address space or the address blocks reserved for documentation in
>    [RFC5737].
> 
>    However RTBH configurations are not documentation, but operationally
>    important features of many public-facing production networks.
>    Furthermore, [RFC3849] specifies that the IPv6 documentation prefix
>    should be filtered in both local and public contexts.  On this basis,
>    it is suggested that both private network address blocks and
>    documentation prefixes described in [RFC5737] are inappropriate for
>    the purpose of RTBH configurations.
> 
> Suggested:
>    manner which is efficient, scalable and straightforward to implement.
> 
>    For IPv4, some networks configure RTBH installations using [RFC1918]
>    address space or the address blocks reserved for documentation in
>    [RFC5737].  However RTBH configurations are not documentation, but
>    operationally important features of many public-facing production
>    networks.  Furthermore, [RFC3849] specifies that the IPv6 documentation
>    prefix should be filtered in both local and public contexts.  On this
>    basis, it is suggested that both private network address blocks and
>    documentation prefixes described in [RFC5737] are inappropriate for
>    the purpose of RTBH configurations.
> 
> Regards,
> Chris
>