Re: [secdir] Fwd: New SG17 proposed work items on IPv6

"many new functions or requirements of IPv6 [including] mandatory  
IPsec ... can be abused for compromising computer systems or networks. "

IPsec does not belong on that list; it is silly to have it there.   
Unless a v6 device is configured with keys and IPsec policy, it will  
behave as if IPsec is not present.  IPsec is mandatory to implement,  
but not mandatory to use, of course.  A great many v4 devices have had  
IPsec for years.  And lastly, it defies logic to say that IPsec can be  
used to compromise a device; DoS is not a compromise.

"National Institute of Information and Communications Technology  
(NICT) has identified more than 60 security threats and  
vulnerabilities that may be caused by new functions or requirements of  
IPv6"   These threats should be referenced so they can be assessed and  
dealt with; the most useful place to publish them would be as an  
internet-draft.

David

On Mar 30, 2011, at 8:52 PM, Fred Baker wrote:

> The attached was passed to me, and I think it is something that  
> would be good for you to comment on to the IETF community.
>
> Begin forwarded message:
>
>> From: Hascall Sharp <chsharp@cisco.com>
>> Date: March 31, 2011 5:24:00 AM GMT+02:00
>> To: "Fred Baker (fred)" <fred@cisco.com>
>> Subject: New SG17 proposed work items on IPv6
>>
>> This is probably not high on your list of things you'd like to see,  
>> but I figured you should be aware of it.
>>
>> "Technical security guideline on deploying IPv6"
>>
>>
> <T09-SG17-C-0454!!MSW-E.doc>
>>
>>
>
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir