Subject: [OPSEC] Call for Adoption: draft-gont-opsec-ipv6-nd-security-01

From: Warren Kumari <[email-masked]>
Date: Wed, 11 Sep 2013 10:17:00 -0400

Dear OpSec WG,

This starts a Call for Adoption for draft-gont-opsec-ipv6-nd-security-01.

The draft is available here: https://datatracker.ietf.org/doc/draft-gont-opsec-ipv6-nd-security-01/

Please review this draft to see if you think it is suitable for adoption by OpSec,
and comments to the list, clearly stating your view.

Please also indicate if you are willing to contribute text, review, etc.

This WGLC ends Wed 25-Sep-2013.

Thanks,
Warren Kumari
(as OpSec WG co-chair)

--
After you'd known Christine for any length of time, you found yourself fighting a desire to look into her ear to see if you could spot daylight coming the other way.

    -- (Terry Pratchett, Maskerade)

---

From: "George, Wes" <[email-masked]>
Date: Wed, 11 Sep 2013 16:16:07 -0400

I think that this is worthwhile work for Opsec to undertake, because ND security is definitely something that not all vendors and SPs have a handle on yet, and it's really useful to have all of the information in one place to be able to point vendors at when trying to improve the state of ND security.

That said, I have some concern about the current format of this document vs. its name and intent. This is supposed to be a security assessment, but rather than simply identifying the current vulnerabilities, it also provides recommendations on how to secure against them. This is certainly good information that I support being in a document, we just need to decide if it belongs in this document and whether that drives a title and abstract change to reflect the document's purpose more accurately, or whether we want to split out mitigation from assessment.
The doc is currently informational, and does not include any RFC2119 boilerplate, but it makes recommendations for behaviors that are not explicitly required by the existing protocol implementation. Many of the places where "...should..." appears in the document look prescriptive/normative to me, and it's not always clear from the text/references whether this is simply reiterating what is already in the standard, or making a new recommendation for better security.

e.g. section 3.1: " If
   the packet does not pass this check, it should be silently dropped.

      While this is not explicitly required in [RFC4861] this provides
      an additional counter-measure (other than the validation of the
      Hop Limit) for non-local malicious nodes willing to make use of
      Router Solicitation messages for reconnaissance purposes."

Perhaps BCP would be a better choice, or info with 2119 keywords, I don't know.

I'd also recommend moving the current section 6 much earlier in the document, so that you start by discussing the vulnerabilities, and then you can go into the recommendations on ND validations (current section 3). I'm not sure how sections 4 and 5 fit into that framework, since they appear to be talking about vulnerabilities as well, but I know that the current one doesn't seem very intuitive to me.

Thanks,

Wes George

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf
> Of Warren Kumari
> Sent: Wednesday, September 11, 2013 10:17 AM
> To: [email-masked]; [email-masked]
> Cc: Warren Kumari
> Subject: [OPSEC] Call for Adoption: draft-gont-opsec-ipv6-nd-security-01
>
> Dear OpSec WG,
>
Anything below this line has been added by my company's mail server, I have no control over it.
-----------------

This E-mail and any of its attachments may contain Time Warner Cable proprietary information, which is privileged, confidential, or subject to copyright belonging to Time Warner Cable. This E-mail is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient of this E-mail, you are hereby notified that any dissemination, distribution, copying, or action taken in relation to the contents of and attachments to this E-mail is strictly prohibited and may be unlawful. If you have received this E-mail in error, please notify the sender immediately and permanently delete the original and any copy of this E-mail and any printout.

---

From: Warren Kumari <[email-masked]>
Date: Mon, 16 Sep 2013 18:01:21 -0400

A reminder that this adoption call is ongoing…

Please review the draft and comment if you think that this should be adopted (or not)

W
On Sep 11, 2013, at 10:17 AM, Warren Kumari <[email-masked]> wrote:

> _______________________________________________
> OPSEC mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/opsec
> 

-- 
"I think it would be a good idea." 
- Mahatma Ghandi, when asked what he thought of Western civilization

---

From: Mikael Abrahamsson <[email-masked]>
Date: Tue, 17 Sep 2013 08:19:28 +0200 (CEST)

> Please review the draft and comment if you think that this should be adopted (or not)

I have read this draft, I have sent comments to authors, and I support its 
adoption.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: RJ Atkinson <[email-masked]>
Date: Wed, 25 Sep 2013 14:50:22 -0400

Earlier, Warren Kumari wrote, in part:
> Please review the draft and comment
> if you think that this should be
> adopted (or not)
> 
> W

Yes, please.

Ran

---

From: Tina TSOU <[email-masked]>
Date: Wed, 25 Sep 2013 19:03:10 +0000

Dear all,
I reviewed this version of the draft.
This document provides a thorough assessment of IPv6 Neighbor Discovery
and the corresponding implementations. 
It documents flaws that have affected popular implementations, along with workarounds to mitigate them. This is a valuable contribution to help improve the maturity of IPv6 Neighbor Discovery implementations, such that issues like RFC 6583 can be proactively addressed.

Thank you,
Tina

---

From: SM <[email-masked]>
Date: Wed, 25 Sep 2013 16:03:48 -0700

>that this should be adopted (or not)

I'll volunteer to review 
draft-gont-opsec-ipv6-nd-security [1].  It's a 
good idea of having a document about security 
assessment of Neighbour Discovery.

Regards,
-sm

1.  draft-gont-opsec-ipv6-nd-security-01 is an expired draft.

---

From: Arturo Servin <[email-masked]>
Date: Thu, 26 Sep 2013 10:00:55 -0300

Yes, adopt.

	This document presents a good assestment of the
challenges/problems/vulnerabilities that ND has.

Regards,
as

---

From: Warren Kumari <[email-masked]>
Date: Mon, 30 Sep 2013 12:27:27 -0400

And the call for adoption has completed.

We see sufficient support to adopt this work.
Authors, please resubmit the document as a draft-ietf-opsec-* document (either before or after addressing Wes's comments).

Thank you everyone for review and submitting feedback, we really appreciate it.

Warren Kumari
(as OpSec WG co-chair)

--
For every complex problem, there is a solution that is simple, neat, and wrong.
                -- H. L. Mencken