Re: [secdir] Secdir review of draft-ietf-dhc-pd-exclude-04

[Magnus Nyström <[e-mail]>]

Thanks Jouni; the text in RFC 3633 looks great. Maybe you could update
the security considerations section in your draft to say (add after
current last sentence):

"In particular, RFC 3633 provides recommendations for protection
against prefix delegation attacks. This specification does not add any
new security considerations beyond those provided by RFC 3633."


? This way, the reader will immediately know that it is covered by 3633.

-- Magnus

On Wed, Feb 8, 2012 at 11:24 PM, jouni korhonen <[e-mail]> wrote:
>
> Magnus,
>
> Thank you for your review. Regarding the authentication of the excluded
> prefix. I admit the security considerations text is thin but, for example,
> RFC3633 security considerations that we refer to already says:
>
>   To guard against attacks through prefix delegation, requesting
>   routers and delegating routers SHOULD use DHCP authentication as
>   described in section 21, "Authentication of DHCP messages" of RFC
>   3315.  For point to point links, where one trusts that there is no
>   man in the middle, or one trusts layer two authentication, DHCP
>   authentication or IPsec may not be necessary.  Because a requesting
>
> We did not come up with anything more specific that should be added.
> Does the above address your concern regarding excluded prefix authentication?
>
> We can add a sentence to the Security considerations saying:
>
> "This specification does not add any new security considerations
>  in addition to those already discussed in RFC3315 and RFC3633."
>
>
> - Jouni
>
>
> On Feb 9, 2012, at 8:43 AM, Magnus Nyström wrote:
>
>> I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors. Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>>
>> This document defines a method for DHCPv6 routers to exclude a prefix
>> out of a delegated set of prefixes.
>>
>> I have no comments on the document itself but the Security
>> Considerations section is very terse. If the method in this draft does
>> not introduce any new security considerations beyond those already
>> present in RFC 3315 or RFC 3633 then it should at least say so. It
>> appears to me however that something could be said about
>> authenticating the request to exclude a particular prefix?
>>
>> -- Magnus
>



-- 
-- Magnus