Subject: Re: New version of draft-ietf-send-psreq to be posted

From: Pekka Nikander <[email-masked]>
Date: Mon, 02 Dec 2002 10:16:22 +0200

Pekka Savola wrote:
> IMO, section 7 of [MAN-SA] is not specific to manual ICMP SA's and should
> be removed to either separate draft or here.  There might be more, other
> generic security discussion there.
> 
> Perhaps Jari might have an opinion?

Jari is on vacation this week but I'm sure he'll return to
to this issue.

>>> 4) it's a bit cornercase whether 4.2.5 could be counted as + in the first 
>>>     case, at least if we assume the DynDNS vulnerability to be possible?
>>
>> I agree that this is a borderline case.  On the other hand, I'd like
>> to see a genuine host-zeroconf design for the corporate intranet case.
>> That is, I'd like to make it possible to plug in a host to a corporate
>> intranet without any configuration (just as today), and let it work
>> securely even in the case that another host is compromised *later*.
>> I'm not sure if we can easily protect against this without any host
>> config.
> 
> Agree -- I really don't have ideas how to deal with this case.  IMO, nodes
> should not just blindly register addresses, but whether they do it (like
> that) is another issue.  Perhaps another footnote..

Added this footnote:

    2) The bogus DNS registration resulting from blindly registering
       the new address via DynDNS is not considered an ND security
       issue here.  However, it should be noted as a possible
       vulnerability in implementations.

--Pekka

--------------------------------------------------------------------
To unsubscribe from this list, send email with "UNSUBSCRIBE" in the
body to <[email-masked]>.
Archive: http://standards.ericsson.net/lists/ietf-send/maillist.html
--------------------------------------------------------------------

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 02 Dec 2002 21:02:28 -0500

I'll go through the draft a bit more thoroughly tomorrow, but..

>        vulnerability in implementations.

it's worth noting that, assuming that DynDNS is being used by a mobile
system, the bogus DynDNS registration is "self healing" once the
mobile system connects to a different network and re-registers.

					- Bill

---

From: Pekka Nikander <[email-masked]>
Date: Tue, 03 Dec 2002 09:39:17 +0200

> I'll go through the draft a bit more thoroughly tomorrow, but..

I'm looking forward to your more thorough comments.  If possible,
I'd like to get the draft into WG LC later this week or early
next week.

> mobile system connects to a different network and re-registers.

Well, it appears to be hard to write this done in a concise form.
For example, hosts using MIPv6 are probably not supposed to register
their care-of-addresses.  I'd rather leave the text as it is.  If you 
want it to be changed, please propose exact text.

--Pekka