Re: [secdir] secdir review of draft-ietf-v6ops-tunnel-loops-01

[Tom Yu <[e-mail]>]

Fred Baker <[e-mail]> writes:

> Question for you. I have left the authors off the paper for the moment.
>
> Mr Gont has recently posted a draft:
>
> http://tools.ietf.org/html/draft-gont-6man-teredo-loops
>   "Mitigating Teredo Rooting Loop Attacks", Fernando Gont, 7-Sep-10,
>   <draft-gont-6man-teredo-loops-00.txt>
>
> and is pushing for adoption as a working group draft. When asked to
> consider merging his paper with this or another draft, he has been
> unwilling. The chairs have basically told him to discuss his draft
> on the list "and we'll see where it goes".

The draft filename implies 6man, not v6ops; which working group was
asked to consider it?  By "his paper", do you mean the following item
in the Informative References of draft-gont-6man-teredo-loops-00?

   [CPNI-IPv6]
              Gont, F., "Security Assessment of the Internet Protocol
              version 6 (IPv6)",  UK Centre for the Protection of
              National Infrastructure, (to be published).

The Teredo attacks and the protocol-41 attacks appear to be mostly
separate, and probably don't interact, with the possible exception of
using a protocol-41 tunnel to initiate a Teredo routing loop attack.

> One of your criticisms of this draft is that it doesn't cover his
> USENIX material. Would you prefer that this and Mr Gont's draft be
> merged?

A reader of this draft might erroneously conclude that it adequately
addresses all of the attacks described in the USENIX paper.  However,
I think it's sufficient to mention the existence of the Teredo
attacks, citing the USENIX paper and the Teredo routing loop draft,
because someone who reads draft-ietf-v6ops-tunnel-loops might not be
aware of the related attacks without reading the actual USENIX paper.

It would also be a good idea to briefly state that the Teredo attacks
are mostly separate from the protocol-41 attacks, and are therefore
treated in another document.