Subject: [secdir] secdir review of draft-ietf-v6ops-464xlat-08

From: Stephen Hanna <[email-masked]>
Date: Sat, 22 Dec 2012 01:38:58 +0000

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments
just like any other last call comments.

This document describes an architecture for providing IPv4 connectivity
across an IPv6-only network. I'm not a fan of documents where the
Security Considerations section just says "See these other two specs
for the Security Considerations" but in this case it seems that this
is adequate. This document is effectively recommends a concatenation
stateless v4/v6 translation on the customer side and stateful v6/v4
translation in the provider so it does make sense that the combination
of the RFC 6145 and RFC 6146 Security Considerations would do it. And
a review of those documents shows that their Security Considerations
are thoughtful and well-considered.

I did find a few minor typos in section 8.2. In the first paragraph:

"a explanation" should be "an explanation"
"using combination" should be "using a combination"
"is delegated IPv6 prefix" should be "is delegated an IPv6 prefix"

Those were the only typos or errors that I found.

Note that I am not an expert in address translation or IPv6 operations
so there could be hidden security issues here that I didn't find.

---

From: joel jaeggli <[email-masked]>
Date: Sun, 23 Dec 2012 10:03:33 -0800

> are thoughtful and well-considered.
I'm in general agreeement  with you here. fundamentally 464xlate is a 
deployment of 6145/6 with specific considerations. I don't believe that  
any new issues are introduced by deploying them in this fashion.