Subject: Re: [secdir] SecDir review of draft-ietf-v6ops-ra-guard-implementation-04

From: Fernando Gont <[email-masked]>
Date: Mon, 12 Nov 2012 15:38:29 -0300

Hi, Kathleen,

My apologies for the delay in my response - it seems that I had not seen
this email! Please find my comments in-line...

On 07/12/2012 11:01 AM, [email-masked] wrote:
> Review Summary:
> The draft is mostly ready (the draft introduces new requirements to
> protect against specific attack vectors and addresses them well), but I
> would recommend some stronger language in the Security Considerations
> section in the following areas:
>  
> In the start of the security considerations section, it says that
> ‘advice’ is given to correct the problems.  Reading through the draft
> this updates and this draft, would saying ‘new requirements’ or
> ‘additional requirements’ be better?  

How about "it introduces requirements for RA-Guard implementations"?

(i.e., RFC 6105 was infrmational, and didn't include any formal
requirements).

> Also, to be compliant with this BCP, shouldn’t the security
> considerations section just require compliance with RFC5722?  

It woudld e inappropriate: RA-Guard is implemented at the layer-2
devices connecting the nodes to be protected, while the requirement to
implement RFC5722 would aim at *those* nodes we want to protect.

Put another way, there's nothing an RA-Guard implementer can do to
force/push compliance with RFC5722 by other nodes.

Thoughts?

Thanks!

Best regards,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492