Re: [Status] Jari Arkko's BLOCK on charter-ietf-spring-00-06

[Hannes Gredler <[e-mail]>]

On Fri, Oct 11, 2013 at 04:11:53PM +0300, Jari Arkko wrote:
| After some off-line chatting, I have a proposal for text to be added to the charter:
| 
| There are a number of serious security concerns with source routing at the IP layer [RFC 5095].  As a part of its work, the working group will define the new IPv6-based routing header in way that blind attacks are never possible, i.e., attackers will be unable to send source routed packets that get successfully processed, without being part of the negations for setting up the source routes or being able to eavesdrop legitimate source routed packets. In some networks this base level security may be complemented with other mechanisms, such as packet filtering, cryptographic security, etc.
| 
| Would this work for people? FWIW from what I can tell, the above should be relatively easily doable, short cookies in headers, etc. It would remove my main concern of accidentally turned on devices becoming a security hole. It would also help deployment, as firewalls might otherwise default to blocking all kinds of routing headers.

jari,

i do not think that packet-filtering is feasible on the default-free-zone
on the internet. - can you take off packet-filtering in favour of security cookies ?

tx,

/hannes