Re: [v6ops] Genart last call review of draft-ietf-v6ops-slaac-renum-03

[Philip Homburg <[e-mail]>]

> Some routers send PIOs in RAs with a valid lifetime of 0 and some
> systems erroneously process that and invalidate said prefix. This
> violates RFC4862 and is a potential DOS vector. If you invalidate
> the prefix, you have weaponized RAs as discussed in RFC4862.

There is a proposal now in 6man to make this required host behavior.
The reasoning is that with RA-guard, this does not introduce a new attack
vector. Without RA-guard, there are already many DOS vectors, and the 
new behavior has benefits that outweigh the downside of one new vector when
there are already many.

> A deprecated valid prefix that actually should be invalid will
> cause less suffering than a non-deprecated prefix in the same
> circumstance, but the no-win situation I was describing remains.

If there is only one SLAAC prefix, then deprecating that prefix is not
an attack vector. If there are two (for example a global one and a ULA) then
deprecating is also an attack vector. However, there are plenty of other
ways to DOS hosts using RAs.