Re: [secdir] Secdir review of draft-ietf-dhc-pd-exclude-04

[jouni korhonen <[e-mail]>]

Magnus,

Thank you for your review. Regarding the authentication of the excluded
prefix. I admit the security considerations text is thin but, for example,
RFC3633 security considerations that we refer to already says:

   To guard against attacks through prefix delegation, requesting
   routers and delegating routers SHOULD use DHCP authentication as
   described in section 21, "Authentication of DHCP messages" of RFC
   3315.  For point to point links, where one trusts that there is no
   man in the middle, or one trusts layer two authentication, DHCP
   authentication or IPsec may not be necessary.  Because a requesting

We did not come up with anything more specific that should be added.
Does the above address your concern regarding excluded prefix authentication?

We can add a sentence to the Security considerations saying:

"This specification does not add any new security considerations
 in addition to those already discussed in RFC3315 and RFC3633."


- Jouni


On Feb 9, 2012, at 8:43 AM, Magnus Nyström wrote:

> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors. Document editors and WG chairs should treat
> these comments just like any other last call comments.
> 
> This document defines a method for DHCPv6 routers to exclude a prefix
> out of a delegated set of prefixes.
> 
> I have no comments on the document itself but the Security
> Considerations section is very terse. If the method in this draft does
> not introduce any new security considerations beyond those already
> present in RFC 3315 or RFC 3633 then it should at least say so. It
> appears to me however that something could be said about
> authenticating the request to exclude a particular prefix?
> 
> -- Magnus