Re: [secdir] secir review of draft-ietf-6man-text-addr-representation-04

[Seiichi Kawamura <[e-mail]>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Tom

Thanks for your comments.
I will add to the Security Considerations
a short paragraph to note on this.

"This document notes on some examples where IPv6 addresses are
compared in textual format. The example on Section 3.2.5 is one
that may cause a security risk if used for access control.
Comparison of X.509 data should be done as binary.

Also, care should be taken in any operational situation where security
measures require the handling of an address in text."

> Editorial:
>
> In Section 3.3.2, I believe the claim that IPv4 addresses cannot be
> abbreviated is false.  Historically, BSD implementations of textual
> IPv4 address parsing have accepted a number of variant abbreviated
> notations.  I think they have generally output canonical dotted-quad
> IPv4 addresses though.

Ahh. needs a bit or rewording. Thank you.

Regards,
Seiichi

Tom Yu wrote:
> This draft indicates that it has no security considerations.  I think
> that conflicts with Section 3.2.5, which gives an example of
> inappropriate (textual) verification of IPv6 addresses in an X.509
> certificate.  Although (in my understanding) IPv6 addresses in X.509
> certificates are in binary form and probably should be compared as
> such, if the authors feel the need to explicitly call out an example
> of inappropriate textual verification of addresses, which could have
> security consequences if the address values in question are used for
> access control.
> 
> The text in Section 3.3.3 about network abuse reporting would also
> appear to have some operational (but probably not protocol) security
> consequences, especially if a network operator would need to respond
> rapidly to an ongoing attack.
> 
> Editorial:
> 
> In Section 3.3.2, I believe the claim that IPv4 addresses cannot be
> abbreviated is false.  Historically, BSD implementations of textual
> IPv4 address parsing have accepted a number of variant abbreviated
> notations.  I think they have generally output canonical dotted-quad
> IPv4 addresses though.
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)

iEYEARECAAYFAktmILAACgkQcrhTYfxyMkKNZACgjA+1rE6ifRKU91jtgLjylI8y
AZ0An1sOPHmWo3nBkILac/gKrKjdWuMK
=BiFx
-----END PGP SIGNATURE-----