Subject: new 6to4 security draft

From: Pekka Savola <[email-masked]>
Date: Mon, 6 Jan 2003 23:51:02 +0200 (EET)

Hello,

Based on the discussion a month ago, I've updated my 6to4 security draft.
Hopefully I didn't lose any significant points along the way.

It has been submitted to the I-D repository, but it's available in the 
meantime from:

http://www.netcore.fi/pekkas/ietf/draft-savola-v6ops-6to4-security-02.txt

Updates include (probably forgot something):
 - add a table and some extra text in summary of threat analysis to make 
comparisons easier
 - add a threat to relays (a copy of "relay spoofing" 5.2.2) which is 
possible if IPv6 source address spoofing is possible (perhaps I was a bit 
too naive about ipv6 ingress-filtering.. :-)
 - add a few short sections on proposed threat mitigation methods
 - remove discussion of using 192.88.99.1 as source
 - minor text addition on strong crypto mechanisms
 - editorial updates

In conclusion, it seems like we're heading towards a situation where we
either have to decide that these are not significant problems or specify
and implement some iTrace-like mechanism *) in certain spots of the
infrastructure (e.g. 6to4 router's decapsulation path could ok).  Or do
some bigger changes like the "More specific 6to4 routes" thing, also
described in the draft.

Comments, text, etc. welcome.

*) it seems to me that iTrace has been in a stall for the last 1-1.5 years
or so, so if a mechanism is needed one should either figure out why there
has been no progress (e.g. an architectural doubt about sending traces all
over the internet) or whether a simplified mechanism should be developed
independently.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: Erik Nordmark <[email-masked]>
Date: Mon, 20 Jan 2003 01:55:07 +0100 (CET)

> over the internet) or whether a simplified mechanism should be developed

I think that is due to the firefighting approach.
There are no widespread source address spoofing attacks, hence folks are
looking at different fires.

But there has been some slow progress on itrace since you sent the above mail.
Making sure that the itrace packet formats can handle IPv6 addresses but the
extra IPv4 address from a 6to4 relay would be a good idea just to keep our
options open.

  Erik