Re: [Status] Jari Arkko's BLOCK on charter-ietf-spring-00-06

[Jari Arkko <[e-mail]>]

Thomas,

> I think a key point is that with IPv6, we are talking (potentially)
> end-to-end exposure of an attack vector. You can have arbitrary end
> nodes anywhere on the Internet injecting traffic that potentially
> directly invokes or impacts source routing. In contrast, one can view
> MPLS as an L2 technology below IP. That means it's deployed in a much
> more restricted setting and a normal sender of TCP/IP has a much more
> restricted attack vector for doing anything that impacts MPLS directly
> (this is key diffference). That means the threat surface for attacks
> on MPLS are very different than for IPv6 more generally.

Yes - a good point. That is one of those restricted cases where it is possible to provide a reasonably secure solution.

But my understanding is that SPRING was at IPv6 layer as well as on MPLS layer… although the charter does not explicitly say it. Just that it is not IPv4…

If SPRING is expected to run at the IPv6 layer, what is the plan to contain the vulnerability?

Jari