Re: [v6ops] Fwd: (IETF I-D): Implications of IPv6 Addressing on Security Operations (Fwd: New Version Notification for draft-gont-opsec-ipv6-addressing-00.txt)

This seems like fairly iffy advice, which is perhaps not surprising given
that the discussion you’re trying to ameliorate seems unrealistic. Thanks
for trying to do something to improve it!

Block lists for ip addresses might be useful, but I suspect are more likely
to cause operational issues—eg I’ve had addresses i use blocked because
someone did something nefarious from them previously.

Where they are appropriate, it is likely because the owner of the full
delegation is untrustworthy, in which case it would make sense to block the
whole range, or even refuse whatever route they publish.

It doesn’t make sense to try to use DHCPv6 or disable temporary addresses
in order to enable the continued use of single-address block lists, and
mentioning it in an IETF document seems harmful. The problem is that the
operator who would be motivated to do this doesn’t control the address
space that is the source of the problem, so they can’t force the owner of
that address space to use DHCPv6 or disable temporary addresses.

Instead, this advice will likely be taken to mean that the use of SLAAC is
generally bad, and should be prevented. This would be a very bad outcome.

Similarly, your observations about /56 delegations making it possible for a
host to pretend to be multiple hosts are likely to discourage ISPs from
offering delegations larger than /64, which again would be an unfortunate
outcome.

The simple advice which I think is appropriate for the context you
described is simply to point out that with IPv6, prefixes are the
identifier, not individual addresses. The rest is too much.

Op ma 6 feb. 2023 om 23:28 schreef Fernando Gont <fgont@si6networks.com>

> Folks,
>
> FYI, this one is targeted at opsec, but might be of interest to this group:
>
> * TXT:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> * HTML:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html
>
> Thanks!
>
> Regards,
> Fernando
>
>
>
>
> -------- Forwarded Message --------
> Subject: (IETF I-D); Implications of IPv6 Addressing on Security
> Operations (Fwd: New Version Notification for
> draft-gont-opsec-ipv6-addressing-00.txt)
> Date: Fri, 3 Feb 2023 01:28:17 -0300
> From: Fernando Gont <fgont@si6networks.com>
> To: opsec@ietf.org
>
> Hi, All,
>
> I happened to participate in an IPv6 deployment meeting with some large
> content provider. Eventually there was a discussion about how to
> mitigate some attacks using block-lists, and they argued that they ban
> offending addresses (/128 for the IPv6 case), following IPv4 practices.
> While they had already deployed IPv6, some of the associated
> implications arising from the increased address space seemed to be
> non-obvious to them.
>
> So that's what motivated the publication of this document.
>
> * TXT:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> * HTML:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.html
>
> Comments welcome!
>
> Thanks,
> Fernando
>
>
>
>
> -------- Forwarded Message --------
> Subject: New Version Notification for
> draft-gont-opsec-ipv6-addressing-00.txt
> Date: Thu, 02 Feb 2023 19:48:40 -0800
> From: internet-drafts@ietf.org
> To: Fernando Gont <fgont@si6networks.com>, Guillermo Gont
> <ggont@si6networks.com>
>
>
> A new version of I-D, draft-gont-opsec-ipv6-addressing-00.txt
> has been successfully submitted by Fernando Gont and posted to the
> IETF repository.
>
> Name:           draft-gont-opsec-ipv6-addressing
> Revision:       00
> Title:          Implications of IPv6 Addressing on Security Operations
> Document date:  2023-02-02
> Group:          Individual Submission
> Pages:          8
> URL:
> https://www.ietf.org/archive/id/draft-gont-opsec-ipv6-addressing-00.txt
> Status: https://datatracker.ietf.org/doc/draft-gont-opsec-ipv6-addressing/
> Htmlized:
> https://datatracker.ietf.org/doc/html/draft-gont-opsec-ipv6-addressing
>
>
> Abstract:
>     The increased address availability provided by IPv6 has concrete
>     implications on security operations.  This document discusses such
>     implications, and sheds some light on how existing security
>     operations techniques and procedures might need to be modified
>     accommodate the increased IPv6 address availability.
>
>
>
>
> The IETF Secretariat
>
>
> _______________________________________________
> v6ops mailing list
> v6ops@ietf.org
> https://www.ietf.org/mailman/listinfo/v6ops
>