Subject: [secdir] secdir re-review of draft-krishnan-v6ops-teredo-update-07

From: Tom Yu <[email-masked]>
Date: Tue, 01 Jun 2010 18:22:26 -0400

This is a re-review of draft-krishnan-v6ops-teredo-update-07, which I
previously reviewed in its -03 version.  Most of my concerns from the
previous review have been adequately addressed.

I concur with the ballot comment by Russ Housley about quantifying the
resistance of this randomization scheme to address scanning in
relation to the general IPv6 address scanning risk.  For example, if
the attacker knows the Teredo server's IPv4 address and client's
external IPv4 address but the client's Teredo UDP port number, the
effective search space after the flag randomization is 28 bits.
Effective address search spaces for similar scenarios can be computed
easily.  Explicitly comparing the values in section 2.3 of RFC 5157
with the search space sizes resulting from implementing the technique
in this update may be helpful to the reader.

---

From: Suresh Krishnan <[email-masked]>
Date: Wed, 2 Jun 2010 01:50:12 -0400

Hi Tom,
   Thanks again for your comments on the new revision. I will try to 
work out with Russ, David and you as to how to best do this comparison 
and I will update the document after we agree.

Thanks
Suresh