Re: [Status] Jari Arkko's BLOCK on charter-ietf-spring-00-06

[Stewart Bryant <[e-mail]>]

On 11/10/2013 19:32, Hannes Gredler wrote:
> On Fri, Oct 11, 2013 at 04:11:53PM +0300, Jari Arkko wrote:
> | After some off-line chatting, I have a proposal for text to be added to the charter:
> |
> | There are a number of serious security concerns with source routing at the IP layer [RFC 5095].  As a part of its work, the working group will define the new IPv6-based routing header in way that blind attacks are never possible, i.e., attackers will be unable to send source routed packets that get successfully processed, without being part of the negations for setting up the source routes or being able to eavesdrop legitimate source routed packets. In some networks this base level security may be complemented with other mechanisms, such as packet filtering, cryptographic security, etc.
> |
> | Would this work for people? FWIW from what I can tell, the above should be relatively easily doable, short cookies in headers, etc. It would remove my main concern of accidentally turned on devices becoming a security hole. It would also help deployment, as firewalls might otherwise default to blocking all kinds of routing headers.
>
> jari,
>
> i do not think that packet-filtering is feasible on the default-free-zone
> on the internet. - can you take off packet-filtering in favour of security cookies ?
>
Packet filtering is prefixed by such as. In some cases it may be 
feasible and better
that a cookie. I can add cookies to the list without requiring any 
particular solution
be picked at this stage. The list is just, I believe to provide 
confidence that a solution
is feasible in the various contexts.

Stewart