Subject: [secdir] Secdir review of draft-ietf-mip4-dsmipv4-07

From: Yaron Sheffer <[email-masked]>
Date: Thu, 30 Oct 2008 12:33:41 +0200

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

I found this document very well written. I did not find additional security
issues beyond those documented in the Security Considerations, other than
the establishment of yet another tunneling method. Such methods are often
abused in order to bypass security middleboxes. However it does make sense
to discuss interactions with the existing documents on MIP4 and MIP6
security, see below.

Security comments:

- There are two recent RFCs on the interaction between Mobile IP and IPsec,
RFC 5265 and 5266. I would expect the current document to refer to the
interaction between IPsec and DSMIP. IPsec for this traffic will be affected
by two factors: (1) protecting MIP4 traffic does not protect *all* traffic,
in the case of tunneling to the CoA, and (2) as always with nested tunnels,
access control policy will not be enforced correctly, because only the
IP-in-IP header will be used to authorize the traffic.

- This document establishes TWO new ways to tunnel IPv6 traffic, one inside
of MIP4 tunneling and another "in parallel" to MIP4 traffic. Security
devices will have to learn how to detect and secure this traffic. I would
expect an informative reference to
draft-ietf-v6ops-tunnel-security-concerns.

Other comments:

- IMHO, the document would be easier to read through if Sec. 3 (formats)
were moved *after* Sec. 4 (processing rules).

- In the IANA considerations, it is unclear if the last paragraph (expert
review) refers to the preceding paragraph, or to both of the new number
spaces.

- 4.3: spelling: mechanisma -> mechanisms

_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir