Subject: [secdir] Secdir review of draft-ietf-dhc-pd-exclude-04

From: Magnus Nyström <[email-masked]>
Date: Wed, 8 Feb 2012 22:43:22 -0800

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors. Document editors and WG chairs should treat
these comments just like any other last call comments.

This document defines a method for DHCPv6 routers to exclude a prefix
out of a delegated set of prefixes.

I have no comments on the document itself but the Security
Considerations section is very terse. If the method in this draft does
not introduce any new security considerations beyond those already
present in RFC 3315 or RFC 3633 then it should at least say so. It
appears to me however that something could be said about
authenticating the request to exclude a particular prefix?

-- Magnus

---

From: jouni korhonen <[email-masked]>
Date: Thu, 9 Feb 2012 09:24:56 +0200

Magnus,

Thank you for your review. Regarding the authentication of the excluded
prefix. I admit the security considerations text is thin but, for example,
RFC3633 security considerations that we refer to already says:

   To guard against attacks through prefix delegation, requesting
   routers and delegating routers SHOULD use DHCP authentication as
   described in section 21, "Authentication of DHCP messages" of RFC
   3315.  For point to point links, where one trusts that there is no
   man in the middle, or one trusts layer two authentication, DHCP
   authentication or IPsec may not be necessary.  Because a requesting

We did not come up with anything more specific that should be added.
Does the above address your concern regarding excluded prefix authentication?

We can add a sentence to the Security considerations saying:

"This specification does not add any new security considerations
 in addition to those already discussed in RFC3315 and RFC3633."

- Jouni

---

From: Magnus Nyström <[email-masked]>
Date: Wed, 8 Feb 2012 23:38:32 -0800

Thanks Jouni; the text in RFC 3633 looks great. Maybe you could update
the security considerations section in your draft to say (add after
current last sentence):

"In particular, RFC 3633 provides recommendations for protection
against prefix delegation attacks. This specification does not add any
new security considerations beyond those provided by RFC 3633."

? This way, the reader will immediately know that it is covered by 3633.

-- Magnus

-- 
-- Magnus

---

From: jouni korhonen <[email-masked]>
Date: Thu, 9 Feb 2012 17:31:16 +0200

Hi,

That works for me. I'll do the update in the next revision.

- Jouni