Subject: [secdir] secdir review of draft-ietf-v6ops-tunnel-loops-01

From: Tom Yu <[email-masked]>
Date: Wed, 29 Dec 2010 23:00:24 -0500

This document describes routing loop vulnerabilities inherent in the
existing design of IPv6-in-IPv4 tunneling protocols, and suggests
mitigation strategies.

While the Security Considerations section of this document claims that
the recommended checks do not introduce new security threats, Section
3.1 mentions that the additional processing overhead for checking
destination and source addresses may be considerable.  It would be
useful to have measurements or estimates of how this additional
processing overhead compares to the effects of the routing loop attack
that it is intended to mitigate.

This document makes no mention of the Teredo attacks that are
discussed in the USENIX WOOT paper.  The authors may wish to mention
draft-gont-6man-teredo-loops-00 for the sake of completeness.

Editorial:

Section 3 lists three categories of mitigation measures but the
accompanying text states that they fall under two categories.

In Section 3.1, in the sentence "However, this approach has some
inherit limitations", replace "inherit" with "inherent".

In Section 4, in the sentence "...other mitigation measures may be
allowed is specific deployment scenarios", replace "may be allowed is"
with "may be feasible in".

---

From: Fred Baker <[email-masked]>
Date: Wed, 29 Dec 2010 23:44:24 -0800

Question for you. I have left the authors off the paper for the moment.

Mr Gont has recently posted a draft:

http://tools.ietf.org/html/draft-gont-6man-teredo-loops
  "Mitigating Teredo Rooting Loop Attacks", Fernando Gont, 7-Sep-10,
  <draft-gont-6man-teredo-loops-00.txt>

and is pushing for adoption as a working group draft. When asked to consider merging his paper with this or another draft, he has been unwilling. The chairs have basically told him to discuss his draft on the list "and we'll see where it goes". 

One of your criticisms of this draft is that it doesn't cover his USENIX material. Would you prefer that this and Mr Gont's draft be merged?