Re: [Status] Jari Arkko's BLOCK on charter-ietf-spring-00-06

[Stewart Bryant <[e-mail]>]

I have taken them out of the list. This is after all a list of examples
and if we discover a cookie like thing is both required and sufficiently
secure we can address that later.

Stewart

On 11/10/2013 20:49, Jari Arkko wrote:
> Cookies are one way to do this, but they are part of the base level security - not the complements. I don't think we should add them to the list.
>
> Jari
>
> On Oct 11, 2013, at 9:52 PM, Stewart Bryant <[e-mail]> wrote:
>
>> On 11/10/2013 19:32, Hannes Gredler wrote:
>>> On Fri, Oct 11, 2013 at 04:11:53PM +0300, Jari Arkko wrote:
>>> | After some off-line chatting, I have a proposal for text to be added to the charter:
>>> |
>>> | There are a number of serious security concerns with source routing at the IP layer [RFC 5095].  As a part of its work, the working group will define the new IPv6-based routing header in way that blind attacks are never possible, i.e., attackers will be unable to send source routed packets that get successfully processed, without being part of the negations for setting up the source routes or being able to eavesdrop legitimate source routed packets. In some networks this base level security may be complemented with other mechanisms, such as packet filtering, cryptographic security, etc.
>>> |
>>> | Would this work for people? FWIW from what I can tell, the above should be relatively easily doable, short cookies in headers, etc. It would remove my main concern of accidentally turned on devices becoming a security hole. It would also help deployment, as firewalls might otherwise default to blocking all kinds of routing headers.
>>>
>>> jari,
>>>
>>> i do not think that packet-filtering is feasible on the default-free-zone
>>> on the internet. - can you take off packet-filtering in favour of security cookies ?
>>>
>> Packet filtering is prefixed by such as. In some cases it may be feasible and better
>> that a cookie. I can add cookies to the list without requiring any particular solution
>> be picked at this stage. The list is just, I believe to provide confidence that a solution
>> is feasible in the various contexts.
>>
>> Stewart
>>
>>
> .
>


-- 
For corporate legal information go to:

http://www.cisco.com/web/about/doing_business/legal/cri/index.html