From nobody Fri Mar 1 13:10:47 2019 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C1720130EE7; Fri, 1 Mar 2019 13:09:56 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: "\"IETF Secretariat\"" To: , Cc: opsec@ietf.org, warren@kumari.net X-Test-IDTracker: no X-IETF-IDTracker: 6.92.1 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <155147459678.6101.10022643348579357229.idtracker@ietfa.amsl.com> Date: Fri, 01 Mar 2019 13:09:56 -0800 Archived-At: Subject: [OPSEC] opsec - Requested session has been scheduled for IETF 104 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 01 Mar 2019 21:09:57 -0000 Dear Liz Flynn, The session(s) that you have requested have been scheduled. Below is the scheduled session information followed by the original request. opsec Session 1 (1:00 requested) Monday, 25 March 2019, Morning Session II 1120-1220 Room Name: Berlin/Brussels size: 100 --------------------------------------------- iCalendar: https://datatracker.ietf.org/meeting/104/sessions/opsec.ics Request Information: --------------------------------------------------------- Working Group Name: Operational Security Capabilities for IP Network Infrastructure Area Name: Operations and Management Area Session Requester: Liz Flynn Number of Sessions: 1 Length of Session(s): 1 Hour Number of Attendees: 25 Conflicts to Avoid: First Priority: dnssd dprive homenet 6man v6ops intarea Second Priority: capport opsawg People who must be present: Ron Bonica Eric Vyncke Warren "Ace" Kumari Resources Requested: Special Requests: --------------------------------------------------------- From nobody Tue Mar 5 14:25:50 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5364812D7EA; Tue, 5 Mar 2019 14:25:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.701 X-Spam-Level: X-Spam-Status: No, score=-2.701 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zYoDYAN1ZsJX; Tue, 5 Mar 2019 14:25:46 -0800 (PST) Received: from mx0a-00273201.pphosted.com (mx0a-00273201.pphosted.com [208.84.65.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B3B1212008A; Tue, 5 Mar 2019 14:25:46 -0800 (PST) Received: from pps.filterd (m0108159.ppops.net [127.0.0.1]) by mx0a-00273201.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x25MOxjm021925; Tue, 5 Mar 2019 14:25:45 -0800 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : cc : subject : date : message-id : content-type : content-transfer-encoding : mime-version; s=PPS1017; bh=gIGqFCYC78jtAsGAzem1Fh45vEdi4+IblzjwMJfS9l0=; b=qDj62ZHDk0loRAtBZRSh6xRPpD32d0awvwVuzoyxhD+TyqZm3j5Tu1WhkuomGxeQOViB x8YTrr0hDXUkon6kBbtbRFRcJsn4nNhrOnirAbbnSNqT8yTfMghdFR1/OI68NIb2y3BN BI3DvLIkaVZTBVGDGM7r1StXTWwdWdeyCJN7+8pbOYc8sxS+XoBwDCY5uzTb7dBL4f7I IORFoFQj1AfERObHBZFkwipyCvhCLkfjDmG/oBDJcZoDFbEtehEw+fZXKyHPRDDrEZLO +nyXEFyGMOGaFp5lSDrwnBaMCFRFy+MlvjUkOygiEqy+flbP/zksgLyKLJZpFUtx7jlP Hw== Received: from nam02-bl2-obe.outbound.protection.outlook.com (mail-bl2nam02lp2054.outbound.protection.outlook.com [104.47.38.54]) by mx0a-00273201.pphosted.com with ESMTP id 2r1x328bjc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-SHA384 bits=256 verify=NOT); Tue, 05 Mar 2019 14:25:45 -0800 Received: from BYAPR05MB4245.namprd05.prod.outlook.com (20.176.252.26) by BYAPR05MB6710.namprd05.prod.outlook.com (20.178.235.216) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.14; Tue, 5 Mar 2019 22:25:43 +0000 Received: from BYAPR05MB4245.namprd05.prod.outlook.com ([fe80::3937:23f4:f61c:a2f8]) by BYAPR05MB4245.namprd05.prod.outlook.com ([fe80::3937:23f4:f61c:a2f8%5]) with mapi id 15.20.1686.015; Tue, 5 Mar 2019 22:25:43 +0000 From: Ron Bonica To: "opsec@ietf.org" CC: "opsec-chairs@ietf.org" Thread-Topic: IETF 104 Thread-Index: AdTTokQASoYcd3LQQeeud78KzmziwA== Date: Tue, 5 Mar 2019 22:25:43 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.1.100.23 dlp-reaction: no-action x-originating-ip: [66.129.241.11] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e439aec7-4576-4a7c-4373-08d6a1b98189 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600127)(711020)(4605104)(4618075)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:BYAPR05MB6710; x-ms-traffictypediagnostic: BYAPR05MB6710: x-microsoft-exchange-diagnostics: =?us-ascii?Q?1; BYAPR05MB6710; 23:PBdWbzB+VLiuQe9FjSPLoZijvp/Pr6V0EGWo1rclL?= =?us-ascii?Q?Wnw/UTfQSyhChU3dUCgY0jfZRfuBB+ywz1vgcsPr35G+6kj7I9i17DRUb1ml?= =?us-ascii?Q?EG8L6bi9US4WrXNZsf/6ZAIccR5QKWifyCUFTXag6Jqg7wa45xURomhLcZIB?= =?us-ascii?Q?g/zzek9sxAdRtD1lRhEbSBWrYMiGrRM/gek3mQq3PzKUIdFRmM1wmqfpv+Ya?= =?us-ascii?Q?e8Nnkl4XcPTO5i2JYm8bAff1+VoLtRDV/gnREpf0prmlLJCIPvFlQhGFl4cM?= =?us-ascii?Q?FsSajMjPCU8nxK6/LtwboT4V1BlV8U1iuFvIxetiZJquz4ZO3p/SHqdT3qyk?= =?us-ascii?Q?+dQX148Fkjn0gQCSoZsrzcWsczrQFu7a4XKFQKqPFM5XOPPvYC3p2nEpXcOH?= =?us-ascii?Q?GpO5OXT7j+lCbwzRvm5R0jhm45AZ+q3cT4c9uubjq5SDKWuFjC4Dx6GNFhDA?= =?us-ascii?Q?/XWAkBH2aeDkby6MnXNduTD0Hg6wy6r2hJ5/wj2xB4OZIWUWqETUhg1VC5eo?= =?us-ascii?Q?8ileKX//eUG69DhlWXIXIFnJ6r/ZDNB6ms73Uo8aQx8/Qv7le85iIRy3bq/R?= =?us-ascii?Q?WvDU++TZqXEewZYHz3MTzy09eAqugTiW/xpdsVQ290Q1Dah8e37rxh6I6xLs?= =?us-ascii?Q?4N8xhT4HdZEX5XaPy3pZXoynFrP0Bv03wr7YUM8DQ9sdZq0VRayYQkJZDeCx?= =?us-ascii?Q?rlwW3J/rYnlzjENPpCO7HV02XpiABspca1DO6pwch7hw9L5l8+k68EYmlAuD?= =?us-ascii?Q?GCmhMXSlZLXtpyyGxqu4wbZYw9T9fBMJ9vJ7iWqbpIqBwHSKgAYKkmt+p4aq?= =?us-ascii?Q?Kl/y19E6VdLixcOI2oL9iAyDIcgP7eYK7fKpeLwvroDyeUuxERf7NpN2XCtw?= =?us-ascii?Q?O1hdum6gD1pEbXGn4j7V5ynV+UjW4Q0/SSDtSiqa6RIDayTj6MeOWn7eOoIO?= =?us-ascii?Q?UesQjPGTL7QyRO2DW9UN5bnJRSEauKsMMvtHXgMax2nulP7S6OLmanrw9GAs?= =?us-ascii?Q?xkcyMaSRulaShzQpEvRVcAoe5Ckn7Vd+OOuPrU29H9hif+gAYH1umyKQpnr6?= =?us-ascii?Q?d9VH66UxXzzuD3KAJAFKi/VuAsCjknh9trEw40OoncvFLAo2NU7k1M+c4ljx?= =?us-ascii?Q?DgEyYgtl+YgbcGMw0Q6fwMJJ0RAP0MxsKmaC270afoDcEp2a3k6wr/SRrXXA?= =?us-ascii?Q?BgdSgQxBczuH3dahm21N7w/Ubuusv9gL0NXlqF9wvfPQeqBuVRXwzsabyv5n?= =?us-ascii?Q?b8T1Y/LvkYxMchrl1o=3D?= x-microsoft-antispam-prvs: x-forefront-prvs: 0967749BC1 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(396003)(346002)(136003)(376002)(366004)(39860400002)(199004)(189003)(3846002)(102836004)(81156014)(6116002)(2351001)(8936002)(1730700003)(8676002)(105586002)(81166006)(74316002)(26005)(52536013)(97736004)(53936002)(66066001)(14454004)(558084003)(256004)(4326008)(478600001)(316002)(106356001)(2906002)(5660300002)(2501003)(7696005)(6506007)(5640700003)(68736007)(6916009)(186003)(6436002)(86362001)(33656002)(7116003)(9686003)(305945005)(71200400001)(71190400001)(55016002)(450100002)(99286004)(486006)(25786009)(7736002)(476003); DIR:OUT; SFP:1102; SCL:1; SRVR:BYAPR05MB6710; H:BYAPR05MB4245.namprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: RPVW7D6QVQnbf2hVPfECXgHYGuk+eHP6fh4vpaUZ6lR30CS0WZEqLl9pk1pZmLp+iKWD0xTYBH/na7kBOFf0SI1AJZgRPgABvcbqool0K/LrDyyEGjTMx6GexlwrIgxBIl0Cz83QdIZqRQmBAEQ8NolGtpRPccu6I7Hfac43NsqkUC/kFG4TyBKdzfvuZqBLsioIGZBISXKJr+2iPHHyy0WICxpItUmBEFjDngiECb0lmrbYVVabg8OAVlDDTnVHrLjeHkRCistTocQ46FkPNd6QPCJvCqxwN4X3il+q3cuLQj1lvX56F0yInPpKdwOsYkGli8PkxMflzGK1QGhtvvo3MxpNUc9XQIl3ailKEBTv6VcWaLp4iD1PTk2R4XUGmhuvZaX2mn7ZxLcYWQBzCa3NrqiYtz1seu21J3+j158= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: e439aec7-4576-4a7c-4373-08d6a1b98189 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Mar 2019 22:25:43.2140 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR05MB6710 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-05_11:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=414 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903050144 Archived-At: Subject: [OPSEC] IETF 104 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 05 Mar 2019 22:25:48 -0000 Folks, If you would like time on the agenda at IETF 104, please send email to opse= c-chairs@ietf.org. = Ron From nobody Wed Mar 6 07:40:48 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C16CF1277D6; Wed, 6 Mar 2019 07:40:45 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -12.601 X-Spam-Level: X-Spam-Status: No, score=-12.601 tagged_above=-999 required=5 tests=[DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=JjaWkX07; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=FBunPSQi Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QiMwb9H_UmPh; Wed, 6 Mar 2019 07:40:44 -0800 (PST) Received: from rcdn-iport-3.cisco.com (rcdn-iport-3.cisco.com [173.37.86.74]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 15A9D1275E9; Wed, 6 Mar 2019 07:40:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=810; q=dns/txt; s=iport; t=1551886843; x=1553096443; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-id:content-transfer-encoding: mime-version; bh=FLD9m0XqG/e2OsmevrXPNuvEEJrnDBoV5V8YqiCXH9g=; b=JjaWkX07ANapM6hf2Zj7GPoHfRqtCrtMMwZUTrmShoGdyhnlojN7WNWL ybP2BlJEsX1U06XfXiWdlKMgbe1wiFBs6n7gyTmw7GkNeHeGCkraRSwdp Lr/v5W/Jc8LvKPtOlHBLnTOPvp3y/F9T+ic90hshxYrz/RqkxvFtCdLET 0=; IronPort-PHdr: =?us-ascii?q?9a23=3AP27boRwNOcXE+mDXCy+N+z0EezQntrPoPwUc9p?= =?us-ascii?q?sgjfdUf7+++4j5YhSN/u1j2VnOW4iTq+lJjebbqejBYSQB+t7A1RJKa5lQT1?= =?us-ascii?q?kAgMQSkRYnBZuIF1z9J/3nRyc7B89FElRi+iLzPA=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0AMAADp6H9c/5ldJa1kGwEBAQEDAQE?= =?us-ascii?q?BBwMBAQGBUQYBAQELAYE8UAOBXAQLJ4QIg0cDhFCLAZp6FIEQA1QLAQEshEA?= =?us-ascii?q?CF4QaIjQJDQEBAwEBAwEDAm0cDIVLBiMRDAEBNwEPAgEIDgwCJgICAjAUARA?= =?us-ascii?q?BAQQBDQWDIoFeAxUBAqALAooUcYEvgngBAQWCRYI7GIILCIELJAGLKBeBQD+?= =?us-ascii?q?BEScfgkyBQYMNARIBNoJzMYImjEeXSgkCkn4ZgWcBDoVmi1OKb5IxAgQCBAU?= =?us-ascii?q?CDQEBBYFHOGVxcBVlAYJBggoYg1aKU3KBKIougj4BAQ?= X-IronPort-AV: E=Sophos;i="5.58,448,1544486400"; d="scan'208";a="520013240" Received: from rcdn-core-2.cisco.com ([173.37.93.153]) by rcdn-iport-3.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Mar 2019 15:40:42 +0000 Received: from XCH-RCD-013.cisco.com (xch-rcd-013.cisco.com [173.37.102.23]) by rcdn-core-2.cisco.com (8.15.2/8.15.2) with ESMTPS id x26FegSU025684 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Wed, 6 Mar 2019 15:40:42 GMT Received: from xhs-rtp-002.cisco.com (64.101.210.229) by XCH-RCD-013.cisco.com (173.37.102.23) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 6 Mar 2019 09:40:41 -0600 Received: from xhs-aln-003.cisco.com (173.37.135.120) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Wed, 6 Mar 2019 10:40:40 -0500 Received: from NAM03-BY2-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Wed, 6 Mar 2019 09:40:40 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector1-cisco-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FLD9m0XqG/e2OsmevrXPNuvEEJrnDBoV5V8YqiCXH9g=; b=FBunPSQiCrfJBQSMDF1f+aXzkBIp2rDWNQ0hQ2RqVuwvBuIsP1hz4nS262QRYko7sKD66ecDXa3bqa3KFTPUt3cX76KdrcLt2tQCI6nvabPDZ4jhjnW1ZSajvE7RlkRhdpdQN/GgzrsKtHxeZxI7QCejZJfk9hOluMjHMhl9A3U= Received: from DM6PR11MB3820.namprd11.prod.outlook.com (20.179.17.28) by DM6PR11MB3257.namprd11.prod.outlook.com (20.176.121.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1665.20; Wed, 6 Mar 2019 15:40:39 +0000 Received: from DM6PR11MB3820.namprd11.prod.outlook.com ([fe80::e5ab:9e18:b14c:9b9c]) by DM6PR11MB3820.namprd11.prod.outlook.com ([fe80::e5ab:9e18:b14c:9b9c%5]) with mapi id 15.20.1665.019; Wed, 6 Mar 2019 15:40:39 +0000 From: "Eric Vyncke (evyncke)" To: Ron Bonica , "opsec@ietf.org" CC: "opsec-chairs@ietf.org" Thread-Topic: IETF 104 Thread-Index: AdTTokQASoYcd3LQQeeud78KzmziwAAmRC2A Date: Wed, 6 Mar 2019 15:40:39 +0000 Message-ID: <6105455F-6DCE-4B03-BA02-123593C674BB@cisco.com> References: In-Reply-To: Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 x-originating-ip: [2001:420:c0c1:36:dd6e:11c:ded8:1ffb] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: f6d19107-74a0-4f37-adba-08d6a24a15fa x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:DM6PR11MB3257; x-ms-traffictypediagnostic: DM6PR11MB3257: x-microsoft-exchange-diagnostics: =?utf-8?B?MTtETTZQUjExTUIzMjU3OzIzOmNUNGVUaFVXSDdLWnYxc0JJQklTU2w0SFVz?= =?utf-8?B?cWJXbVhrb1U1Q0xORDd0eGVlSTZTOC9kSG5iS01PYUhzVDVReVBWMVpBRWVL?= =?utf-8?B?VE9ZZjk1R04rMWVhbGFLWllpOHY2MFZ6eHMvNjNzRUdqai9sNnRLRnIvRkIv?= =?utf-8?B?emFhdmQ2MStQTXU2VTJ6ejFTbys5MmRqWkg0VndPL2dzS3BrSU1CQTlhZm1n?= =?utf-8?B?T0k1WGVYeEYxY2dvQ1l3N2xGa21BMWF5ZWs3TGlGVWNHYjVhVHQyVlUvdURj?= =?utf-8?B?cWh6NFB5VWdNUjNVcU9raERvcXdQTUlQK0srYmpCMExHc0JsdzIzWm9qQ0E3?= =?utf-8?B?VHN6bmJmc2R1T0JwWitMREVBOGhoUXdWZExaUi9VbmdjMzhtaFE0Q2pycSt5?= =?utf-8?B?azRLQTBFQ0RvZXFrQk8wWTZmTCtUSWN0elNrTnk4UFNYZGJxTG1DZks0TGti?= =?utf-8?B?b0pZb3h1d2F1Nzk4c0RObGJyM0ZvRHVTUzlDZmxHam0zRnVHNG1VSW5SSDk1?= =?utf-8?B?c3Z6TDl2MzNreWRRbWJaSEluUjV6a0dLNWpvR3J0dUo4RVN5aGRWSFYvSDZN?= =?utf-8?B?WVFXSmZtcExZOC9TS1JWMEVZdVNiVzBYSStxM1JvNmdrUkVRK1BsdVZZV1V3?= =?utf-8?B?V2VFVHRQVGR0aTdVVU5Ta1FhTjNvZ3ZiM1lML2VFRkpzN2JMNUJKUFYzMFQ2?= =?utf-8?B?cmRFb3pWOFBGRGxNVklxK3pVWUViRFFZSGtrRGJweFpjMHE0K2U3b21GcFIx?= =?utf-8?B?c2pHRlVaS2wwWUxGWkRjWGxDdXlicXhSL3NxTDhtZkNqZHZVMGJwTk5PYlFs?= =?utf-8?B?S1NBeWU0dzRRTnJPaGNjd01FRHVjckpmRFpvYm1kTUVoOVFsVHFkNG4xRDJ0?= =?utf-8?B?UVhHSGZEdFFhNEprbUNwUkpkcUwwQnpqMldZcGZ2NG44WEh4T2NvOVltRlVD?= =?utf-8?B?ZC9acGNpdUNvT1RQT2lFeTN1emNCVElXZDhjQSs4amtTSzVDdTI2bmkvaS8y?= =?utf-8?B?RWRYSUVueXFrb2lUZDQwVGpibEhrWU5ySzV5QkxBRzAxS1NKeXJzTUxSVmhD?= =?utf-8?B?dW82UlNuVzR3a08vQWVQOGpqeVcxbzZnd2Znb2tJOUNxWEVzczRma3RyVWo0?= =?utf-8?B?aXNmNGN5TkZaK1JlTUpDMTRtbjJMN2hDZXFaaDNXc21aeWpGdzB1MWhyVGJz?= =?utf-8?B?SUdwM1FkWk92Ry9QcHR3VytaZGl1eUtsZEtrSzFjN212WlVWemtvdkFEZ3pj?= =?utf-8?B?UUZ0TVNzWmVmWlVSZXVFU3JZNHJQUFlIejVzOHd3ckduMWtIMWxGMGRKNHRv?= =?utf-8?B?c3hZU3JzbXhVV3BQeEZUTk9xTXoyYThqaGp5OGFWWHFTOGZBMXV5am1RWDZJ?= =?utf-8?B?Ulg2M2VleHhDdW52ZEUzNGhyQTBxRVFXU2J4eDQxdWJEaHpyVEFFeTNId2ds?= =?utf-8?B?Y042d1FMcDNtUnlqNkVQZGFxaGxNS1FsbHpNM0MxN09hbnpVOWd6NkxWR0tQ?= =?utf-8?B?VFBLZTJaYnRqTm5BNWZLb1p5bW9BY0liVFpGRW94SEZkM1pnWDFKMm12Rmdk?= =?utf-8?B?Y0x6cldRUHlNUjlFWXlxbTExZm5SRkNVQzM5TVBFU2FCbUJZeFN0SVBKVHUx?= =?utf-8?B?d2VwR2pPM1FBNm9oNkhzaUUxVDUxTjJNQXV2NGFjL3RsalQrS043ZWZuTWxO?= =?utf-8?B?SUh6aUkrOVF0STRRUGNJcFpMbFFzVUlUaDdLT0ZYZG16dWk5bGxPUDR5a3VD?= =?utf-8?B?cUlpSUJZK0J4M2J1bGZSL1VHaklCNkdTMGphYXptUjY5RmhxdlUrT1BJWDht?= =?utf-8?Q?nQnNLVQDD+thr?= x-microsoft-antispam-prvs: x-forefront-prvs: 0968D37274 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(366004)(39860400002)(396003)(346002)(376002)(504964003)(54534003)(189003)(199004)(305945005)(4326008)(33656002)(6436002)(4744005)(6486002)(36756003)(6506007)(102836004)(2906002)(6246003)(25786009)(71190400001)(71200400001)(6346003)(256004)(86362001)(76176011)(5660300002)(99286004)(83716004)(6512007)(82746002)(53936002)(6116002)(229853002)(7116003)(2616005)(81166006)(8676002)(106356001)(14454004)(486006)(105586002)(46003)(11346002)(8936002)(81156014)(446003)(476003)(1941001)(97736004)(7736002)(186003)(316002)(58126008)(110136005)(478600001)(68736007)(2501003); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB3257; H:DM6PR11MB3820.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; MX:1; A:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) authentication-results: spf=none (sender IP is ) smtp.mailfrom=evyncke@cisco.com; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: KW6RjTcDVb8d6U/YOzxj5pdOrNzFoDQbQeTXQHkWqozqdJFRZGo0IOmRISKbLZuNAZZ2CV/R3jagswMROeojOfvwOscD0aEXxBuU4/yldYI2kWCWs8eamSq7ZPmDbxd6dwpyUUSK3Rs6pbblNhZ/k1Tbq0I75hIpAoHmEIpKxU+vA3FPuK6FiIekm8Lc3im4TXopR+V+mPEKsCdAT+8SF6JkikF2+n4VsOwtGBcJNmNiA4zmrp5GtyT6n3powLMjaXT1SgyLfnDhVEkVayrttmxFzxKSt7tSi93JzrD4lGU6MbgM17jHQWu8bxzPUj6GxsGr3vAL/V7Fsw//3oBZ+HeNcwDUVMlpFa2DN1HhRRbR0WKlDuJnqODmVW7uNQ5RofBni0ZrlCdDdJJ6GRAnTDJhKI7hEz1G485fm3SNiPs= Content-Type: text/plain; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: f6d19107-74a0-4f37-adba-08d6a24a15fa X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Mar 2019 15:40:39.7522 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3257 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.23, xch-rcd-013.cisco.com X-Outbound-Node: rcdn-core-2.cisco.com Archived-At: Subject: Re: [OPSEC] IETF 104 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 06 Mar 2019 15:40:46 -0000 Um9uLA0KDQpUaGUgT1BTRUN2NiBhdXRob3JzIHdvdWxkIGxpa2UgdG8gcHJlc2VudCB0aGUgLTE1 IHJldmlzaW9uICh0byBiZSB1cGxvYWRlZCBpbiB0aGUgY29taW5nIGRheXMpIHdpdGggdGhlIGlu dGVudCBvZiBhc2tpbmcgZm9yIFdHTEMuDQoNClByZXNlbnRlciB3aWxsIGxpa2UgYmUgS2lyYW4g Sy4gQ2hpdHRpbWFuZW5pIGZvciAxMC0xNSBtaW51dGVzIGFzIHdlIHdpbGwgcHJlc2VudCB0aGUg Y2hhbmdlbG9nICsgYXNrDQoNClRoYW5rIHlvdSBpbiBhZHZhbmNlDQoNCi3DqXJpYw0KDQrvu79P biAwNS8wMy8yMDE5LCAyMzoyNSwgIlJvbiBCb25pY2EiIDxyYm9uaWNhQGp1bmlwZXIubmV0PiB3 cm90ZToNCg0KICAgIEZvbGtzLA0KICAgIA0KICAgIElmIHlvdSB3b3VsZCBsaWtlIHRpbWUgb24g dGhlIGFnZW5kYSBhdCBJRVRGIDEwNCwgcGxlYXNlIHNlbmQgZW1haWwgdG8gb3BzZWMtY2hhaXJz QGlldGYub3JnLg0KICAgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICBSb24NCiAgICANCiAgICANCg0K From nobody Sat Mar 9 12:32:21 2019 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 90592124B19; Sat, 9 Mar 2019 12:32:12 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsec@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.93.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: opsec@ietf.org Message-ID: <155216353255.28690.611573903036715612@ietfa.amsl.com> Date: Sat, 09 Mar 2019 12:32:12 -0800 Archived-At: Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-15.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Mar 2019 20:32:13 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF. Title : Operational Security Considerations for IPv6 Networks Authors : Eric Vyncke Kiran K. Chittimaneni Merike Kaeo Enno Rey Filename : draft-ietf-opsec-v6-15.txt Pages : 50 Date : 2019-03-09 Abstract: Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in several places of a network (enterprises, service providers and residential users) and proposes technical and procedural mitigations techniques. Some very specific place of a network such as Internet of Things are not discussed in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsec-v6-15 https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-15 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-15 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Sat Mar 9 13:12:26 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CC5501295D8 for ; Sat, 9 Mar 2019 13:12:15 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=GIkiF0DT; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=HalwP1yG Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TvmFkaxQLW9M for ; Sat, 9 Mar 2019 13:12:12 -0800 (PST) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 953B9129BBF for ; Sat, 9 Mar 2019 13:12:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=11575; q=dns/txt; s=iport; t=1552165932; x=1553375532; h=from:to:subject:date:message-id:mime-version; bh=YCc4TFwpgEPeWjHzKIOjEBTFGGo/HU1XQGPLQeK58aU=; b=GIkiF0DTXTNSQKN/mW7A4TVrRy5lqQiEikSAhuUE/C3PCq/puK4a+oIU QdrGibqV3vAetI4up/drQKzu/de8JjdRkjQZ43yOewIna4HtwtQQsR5SQ IkmPV14qSgNiUks+tTAw5MeUbafDXHH4SuB90lLu2wqYLC+FAgTWEPd4g o=; IronPort-PHdr: =?us-ascii?q?9a23=3AzfRixBayZDe8O9OewP8scd//LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el20gebRp3VvvRDjeee87vtX2AN+96giDgDa9QNMn?= =?us-ascii?q?1NksAKh0olCc+BB1f8KavncT08F8dPfFRk5Hq8d0NSHZW2ag=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BMAADZK4Rc/4UNJK1kHgEGBwaBUQk?= =?us-ascii?q?LAYENL1ADaHQECyeECYNHA481SoFokliFc4EkA1QLAQEjCYRAGYQeIjQJDQE?= =?us-ascii?q?BAwEBBwEDAm0cAQuFdB0BATgRAQZEAgQwJwSDNQGBEUwDFQECDJMRkF8CihR?= =?us-ascii?q?xgS+CeAEBBYJGgjUYggwDBYEvAYssF4FAP4ERJwwThWoCAgEXgXSCXTGCJox?= =?us-ascii?q?NhAiTTwkCgXuFVIN8hz8ZkzqKeIVljGICBAIEBQIOAQEFgUc4gVZwFWUBgkG?= =?us-ascii?q?CCoNuhRSFP3IBgSeNECqCIwEB?= X-IronPort-AV: E=Sophos;i="5.58,461,1544486400"; d="scan'208,217";a="242684643" Received: from alln-core-11.cisco.com ([173.36.13.133]) by alln-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 09 Mar 2019 21:12:02 +0000 Received: from XCH-RCD-012.cisco.com (xch-rcd-012.cisco.com [173.37.102.22]) by alln-core-11.cisco.com (8.15.2/8.15.2) with ESMTPS id x29LC2SQ002344 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL) for ; Sat, 9 Mar 2019 21:12:02 GMT Received: from xhs-rtp-002.cisco.com (64.101.210.229) by XCH-RCD-012.cisco.com (173.37.102.22) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sat, 9 Mar 2019 15:12:02 -0600 Received: from xhs-aln-003.cisco.com (173.37.135.120) by xhs-rtp-002.cisco.com (64.101.210.229) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Sat, 9 Mar 2019 16:12:00 -0500 Received: from NAM03-DM3-obe.outbound.protection.outlook.com (173.37.151.57) by xhs-aln-003.cisco.com (173.37.135.120) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Sat, 9 Mar 2019 15:12:00 -0600 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector1-cisco-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=YCc4TFwpgEPeWjHzKIOjEBTFGGo/HU1XQGPLQeK58aU=; b=HalwP1yG+YC86aL4s9fZsGBKPdSknpJH51zOHYTfg78bF6GtoZLTFIkJ4iETRyaNQI1eWOI5kaCZymuGRSWCQ8u3aG8ZRZC7I4ksaFhjgF/Vmw0TWmKoUO82EQ50dsBl3P80bKeeGGZ6gq0NmuAcQWZ5Idm2jvkrhSX159RS+VA= Received: from DM6PR11MB3820.namprd11.prod.outlook.com (20.179.17.28) by DM6PR11MB3737.namprd11.prod.outlook.com (20.179.16.19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.18; Sat, 9 Mar 2019 21:11:59 +0000 Received: from DM6PR11MB3820.namprd11.prod.outlook.com ([fe80::e5ab:9e18:b14c:9b9c]) by DM6PR11MB3820.namprd11.prod.outlook.com ([fe80::e5ab:9e18:b14c:9b9c%5]) with mapi id 15.20.1686.021; Sat, 9 Mar 2019 21:11:59 +0000 From: "Eric Vyncke (evyncke)" To: "opsec@ietf.org" Thread-Topic: What is new in draft-ietf-opsec-v6-15 ? Thread-Index: AQHU1ry7cG9/PTO2OE2GyF5Yh/a/0Q== Date: Sat, 9 Mar 2019 21:11:59 +0000 Message-ID: <88F7F6C8-2787-4AE7-B344-B341DBC08CD2@cisco.com> Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=evyncke@cisco.com; x-originating-ip: [2001:420:c0c1:36:c504:914a:c2f0:b817] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: d99ff324-c09b-4eb0-88ac-08d6a4d3de60 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:DM6PR11MB3737; x-ms-traffictypediagnostic: DM6PR11MB3737: x-ms-exchange-purlcount: 1 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtETTZQUjExTUIzNzM3OzIzOkpQZU9BdDh1NjY3blZCSTY3aWdua2o1b1h5?= =?utf-8?B?dlEyNkdROTR0bkZETGs0MEYwV0ZjaVZ4WWUyL1VGTWtvd256NURnd29MakZl?= =?utf-8?B?Ylk0NVNMUFdBSnMvdjNZVDhsNDZjaDZDTTVMRCtTUVJDN2JlZGo3TUpGK1Zy?= =?utf-8?B?NHBxSFZwTzhqeFBldjFwYWVqMHZqZFhCNFpFc0V6QzAvc2FEekRqVFhHZDRq?= =?utf-8?B?eEtyVi93VnVadm82cDFYSllraWR0UFBYOFZOblh6VTR5N3lDRVJZL2RlR3Z5?= =?utf-8?B?Y2dmNDBxUDNRQ2RTcEw1dnVidWxzRUtLQlQ4dlJTVEl3Ty9MaHk2TjFBYW1y?= =?utf-8?B?REtDcFBaQnFzTkhMajRUQ0xIM25pRjV2a1Q5WmZVNS95TVVOY0o0YlN0TEE2?= =?utf-8?B?b25lZjFaancrQTF5YjNIUjFFUHVQNXN3Zm1tQjA5K3JqajBOQVNKbHUzcDR1?= =?utf-8?B?N1NnVDFqR2RUUkM0cGV0aWV5NndRQ2R6QmFxdXNaV2NQeUQ1eEN3NGR2M05F?= =?utf-8?B?b2hGT3lURWpvS3NGYWNObTRacHNvWU00bmh5dEYrRFFuQXA5MHUrelRaenZK?= =?utf-8?B?d2JOamFwaXV6OStLOExHZU5DV25DMGY1VjN3RTE4dDZ5N29JN0ZmNDB1eExq?= =?utf-8?B?N0cyaXVrMHorZjZmRGpEY25WRzVtcnBZZUpGYWYyQzU2OEdpNnVJQkpPODhK?= =?utf-8?B?SzNMTE42RWNtTGNkMTJhK3JVbFdqMGxFMVo3cHgwWEMxbjY5WllOVWN1K0h2?= =?utf-8?B?MUNGMGM5WVFWamFBQ25pam9Vdk9Ec1hqYkZhNVNSeTVPUk9xajdFUzUvMmtI?= =?utf-8?B?TkRPdGU3QzVKdGhFaDJCUEI0Y0ZiREJhek5idUlWTzNyWnRnQ21WR1Y2TVVm?= =?utf-8?B?aDRKRExKZWRnT2NZamszTm81NzRaZ1pLZ1VlTVoxMm9Bd3VSVmErelpyY1dt?= =?utf-8?B?akMydkgzeW9lOWl3Y1lOL3lVRXdWenRqbHJlNEhPRStQczhvbXR4ZCtpdTh5?= =?utf-8?B?ZXdISzhMNmk4RFNLZEkzS0RIejRvb08xWWZObkZFRTdoQkhqK3h5a0pIWXZy?= =?utf-8?B?Slc4S25DcysyZWg4VUhZWkpxME9QWkFKZVlncUhycGdUMUJxM1dpdHNqSXZo?= =?utf-8?B?TDcyQzltcHJNcDF1eHRueUJzMjlIdGREeFFuQXVENHMveDkwY1ZTU0srQkV1?= =?utf-8?B?RGVocnBWL1JvcTMyWGpIaHp5VTFsZi9xUmdtN2xkYitTYjBqYktqNWFSZG5W?= =?utf-8?B?cE0zOFB0RUs2OWpqTk1XK2U4NHFyVm9SZU05R3MzZlpyaGYvN29ZbDZCR3dj?= =?utf-8?B?eUpyN3ppM3hueGhjSVI3d3o0Z1RZNVptd1Nmd2tBWlpMVEtWd3p2OHZkQzRG?= =?utf-8?B?bFpwVWpKY2RlUVhHQUhtZVJGblV5MXFOblQrbWlWSTdFL3U5bU9Vcjh5OXBL?= =?utf-8?B?QlBHTjd4M3dud2VWWTJWT0thbEpNcjFqMkJ6MUhvUWViVS9ZSGlZNVpoSmRU?= =?utf-8?B?WWZDQm1ZVGFaS2wvMW9jRjdCU0VjbmVxcmYzT0VhQ3FKbm96bmJ3NlV4SXpU?= =?utf-8?B?U2ZmTkxoeUlSSldRVElVaWlzUzZiRmdBOHY4czVPMnZGc0Y3N1JNNXd3dW5o?= =?utf-8?B?aGtSamJ5Y3FZY1N6QXNPWkZTeVJjT2pEcCtMUmw1QkFmYVNDbkRhYU5ZRVZk?= =?utf-8?Q?upHYkYkohNwCjaEprU=3D?= x-microsoft-antispam-prvs: x-forefront-prvs: 0971922F40 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(376002)(346002)(136003)(396003)(366004)(199004)(189003)(102836004)(83716004)(6436002)(97736004)(2351001)(105586002)(5640700003)(82746002)(33656002)(476003)(2616005)(316002)(486006)(2501003)(81166006)(14454004)(25786009)(106356001)(58126008)(36756003)(2906002)(86362001)(6916009)(71190400001)(8676002)(1730700003)(46003)(71200400001)(81156014)(478600001)(53936002)(6512007)(236005)(186003)(6486002)(966005)(5660300002)(606006)(6116002)(7736002)(68736007)(6506007)(14444005)(256004)(54896002)(8936002)(6306002)(99286004); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB3737; H:DM6PR11MB3820.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: kajhZnyhpV+xzNaWNEthGWnjEBP/keMPif77MympagPw+yojH6cawdgOfQ5Frjfs15APlGXR4IaXl/IRdXAx5zT/0QLw46W1rTUjDxTKDYmV0XNGE6+X9wc3ZdX05zfyNfZaWq5H/Y1PDYRjYlWSOHWZMSF7YvovUYNX2mhXiWmRr8bDSRawu9vJHDWWyH3LmM/WwGFNMeVezddVpb9bK9/3GYo424qMbV9MLfnrkJmgoCaNOvkj5QQTlULyBdzX2iKHiw6/Ndlpg9TNkBqDONhpjB8vPVwyuGrhgaAUlxd6CpmaSMObYK/C8JSgCqFJ7bXa7BwlKDLsDoXrY95c9JRApJRwDu62gEJAmlW0BI58IFFKFIPOlYW2+kvZjAfTp9AQYfgYWhB8RCPXd7rrC1THn60blOqGuFy37ruTlLs= Content-Type: multipart/alternative; boundary="_000_88F7F6C827874AE7B344B341DBC08CD2ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: d99ff324-c09b-4eb0-88ac-08d6a4d3de60 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Mar 2019 21:11:59.3835 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3737 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.22, xch-rcd-012.cisco.com X-Outbound-Node: alln-core-11.cisco.com Archived-At: Subject: [OPSEC] What is new in draft-ietf-opsec-v6-15 ? X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Mar 2019 21:12:25 -0000 --_000_88F7F6C827874AE7B344B341DBC08CD2ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 VGhlIGF1dGhvcnMgaGF2ZSBwdWJsaXNoZWQgYSBuZXcgdmVyc2lvbi4NCg0KQXMgdXN1YWwsIHRo ZSBkaWZmIGlzIGh0dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZjZGlmZj91cmwyPWRyYWZ0LWlldGYt b3BzZWMtdjYtMTUudHh0DQoNCkJ1dCwgaXQgY29uc2lzdHMgbWFpbmx5IChiYXNlZCBvbiBjb21t ZW50cyBmcm9tIEZlcm5hbmRvIGFuZCBvdGhlcnMpOg0KDQogICogICBTb21lIGNoYW5nZXMgaW4g dGhlIGZsb3cvb3JkZXIgdG8gbWFrZSBpdCBtb3JlIHJlYWRhYmxlICsgZml4aW5nIHR5cG9zDQog ICogICBSZWZyZXNoIG9mIHRoZSByZWZlcmVuY2VzIChJLUQgYmVjb21pbmcgUkZDLCBvciBSRkMg b2Jzb2xldGluZyBvdGhlciBSRkMsIElFVEYgaXMgYWxpdmUg8J+YiikNCiAgKiAgIFNlY3Rpb24g Mi4xLjIgYWJvdXQgVUxBIGlzIGV2ZW4gc2hvcnRlciBhbmQgd2UgaG9wZSBmdWxseSBhZGRyZXNz ZXMgdGhlIGNvbW1lbnRzIHJlY2VpdmVkIGF0IElFVEYtMTAxIGFuZCBJRVRGLTEwMg0KICAqICAg U2FtZSBmb3Igc2VjdGlvbiAyLjEuNCBhYm91dCB0ZW1wb3JhcnkgYWRkcmVzc2VzDQogICogICBT ZWN0aW9uIDIuMi4zIG1vcmUgdGV4dCB0byBjbGFyaWZ5IHRoZSBmcmFnbWVudCBoZWFkZXINCiAg KiAgIFNlY3Rpb24gMi42IG1lbnRpb24gU0FWSSBsb2dnaW5nIHRvIGhlbHAgZm9yIG1vbml0b3Jp bmcgb2YgPElQLCBNQUM+IGFkZHJlc3NlcyBtYXBwaW5nDQogICogICBBZGRlZCBzb21lIHRleHQg aW4gMi43LjMgYWJvdXQgc29tZSB0cmFuc2xhdGlvbiBtZWNoYW5pc21zIHNoYXJpbmcgc29tZSBp c3N1ZXMgd2l0aCBDR04NCg0KVGhlIGF1dGhvcnMgaGF2ZSByZXF1ZXN0ZWQgYSBzbG90IHRvIHBy ZXNlbnQgdGhvc2UgY2hhbmdlcyBhdCB0aGUgT1BTRUMgV0cgbWVldGluZyBhdCBJRVRGLTEwNCBh cyB3ZWxsIGFzIFY2T1BTICh0byBjb2xsZWN0IGZlZWRiYWNrL3Jldmlld3MgZnJvbSBvcGVyYXRv cnMpLg0KDQpBcyB1c3VhbCwgd2Ugd2VsY29tZSBjb21tZW50cyBhbmQgcmV2aWV3cyBlc3AgYmVm b3JlIHRoZSBQcmFndWUgbWVldGluZyBhcyB3ZSB3aWxsIHJlcXVlc3QgYSBXR0xDIG9uIHRoaXMg ZG9jdW1lbnQNCg0KUmVnYXJkcywgZm9yIHRoZSBhdXRob3JzLA0KDQotw6lyaWMgLW1lcmlrbyAt a2sgLWVubm8NCg0K --_000_88F7F6C827874AE7B344B341DBC08CD2ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: <456286BB9F0B5449B187B05BC29E9EC8@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseTpXaW5nZGluZ3M7DQoJcGFub3NlLTE6NSAwIDAgMCAwIDAgMCAwIDAg MDt9DQpAZm9udC1mYWNlDQoJe2ZvbnQtZmFtaWx5OiJDYW1icmlhIE1hdGgiOw0KCXBhbm9zZS0x OjIgNCA1IDMgNSA0IDYgMyAyIDQ7fQ0KQGZvbnQtZmFjZQ0KCXtmb250LWZhbWlseTpDYWxpYnJp Ow0KCXBhbm9zZS0xOjIgMTUgNSAyIDIgMiA0IDMgMiA0O30NCi8qIFN0eWxlIERlZmluaXRpb25z ICovDQpwLk1zb05vcm1hbCwgbGkuTXNvTm9ybWFsLCBkaXYuTXNvTm9ybWFsDQoJe21hcmdpbjow Y207DQoJbWFyZ2luLWJvdHRvbTouMDAwMXB0Ow0KCWZvbnQtc2l6ZToxMi4wcHQ7DQoJZm9udC1m YW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBzcGFuLk1zb0h5cGVybGluaw0K CXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjNDMTsNCgl0ZXh0LWRlY29yYXRp b246dW5kZXJsaW5lO30NCmE6dmlzaXRlZCwgc3Bhbi5Nc29IeXBlcmxpbmtGb2xsb3dlZA0KCXtt c28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6Izk1NEY3MjsNCgl0ZXh0LWRlY29yYXRpb246 dW5kZXJsaW5lO30NCnAuTXNvTGlzdFBhcmFncmFwaCwgbGkuTXNvTGlzdFBhcmFncmFwaCwgZGl2 Lk1zb0xpc3RQYXJhZ3JhcGgNCgl7bXNvLXN0eWxlLXByaW9yaXR5OjM0Ow0KCW1hcmdpbi10b3A6 MGNtOw0KCW1hcmdpbi1yaWdodDowY207DQoJbWFyZ2luLWJvdHRvbTowY207DQoJbWFyZ2luLWxl ZnQ6MzYuMHB0Ow0KCW1hcmdpbi1ib3R0b206LjAwMDFwdDsNCglmb250LXNpemU6MTIuMHB0Ow0K CWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5zLXNlcmlmO30NCnNwYW4uRW1haWxTdHlsZTE3DQoJ e21zby1zdHlsZS10eXBlOnBlcnNvbmFsLWNvbXBvc2U7DQoJZm9udC1mYW1pbHk6IkNhbGlicmki LHNhbnMtc2VyaWY7DQoJY29sb3I6d2luZG93dGV4dDt9DQouTXNvQ2hwRGVmYXVsdA0KCXttc28t c3R5bGUtdHlwZTpleHBvcnQtb25seTsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsc2Fucy1zZXJp Zjt9DQpAcGFnZSBXb3JkU2VjdGlvbjENCgl7c2l6ZTo2MTIuMHB0IDc5Mi4wcHQ7DQoJbWFyZ2lu OjcyLjBwdCA3Mi4wcHQgNzIuMHB0IDcyLjBwdDt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6 V29yZFNlY3Rpb24xO30NCi8qIExpc3QgRGVmaW5pdGlvbnMgKi8NCkBsaXN0IGwwDQoJe21zby1s aXN0LWlkOjEwMTA5MTIyNDI7DQoJbXNvLWxpc3QtdHlwZTpoeWJyaWQ7DQoJbXNvLWxpc3QtdGVt cGxhdGUtaWRzOjE3MTIwOTQxMzIgLTg4NTc3OTA1MCA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4 OSA2NzY5ODY5MSA2NzY5ODY5MyA2NzY5ODY4OSA2NzY5ODY5MSA2NzY5ODY5Mzt9DQpAbGlzdCBs MDpsZXZlbDENCgl7bXNvLWxldmVsLXN0YXJ0LWF0OjA7DQoJbXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Oi07DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7 DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7DQoJbXNvLWZhcmVhc3QtZm9udC1m YW1pbHk6Q2FsaWJyaTt9DQpAbGlzdCBsMDpsZXZlbDINCgl7bXNvLWxldmVsLW51bWJlci1mb3Jt YXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Om87DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7 DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7 DQoJZm9udC1mYW1pbHk6IkNvdXJpZXIgTmV3Ijt9DQpAbGlzdCBsMDpsZXZlbDMNCgl7bXNvLWxl dmVsLW51bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CpzsNCgltc28tbGV2 ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4 dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpXaW5nZGluZ3M7fQ0KQGxpc3QgbDA6bGV2 ZWw0DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDrv grc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1wb3NpdGlv bjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6U3ltYm9sO30NCkBs aXN0IGwwOmxldmVsNQ0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpidWxsZXQ7DQoJbXNvLWxl dmVsLXRleHQ6bzsNCgltc28tbGV2ZWwtdGFiLXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVy LXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRlbnQ6LTE4LjBwdDsNCglmb250LWZhbWlseToiQ291 cmllciBOZXciO30NCkBsaXN0IGwwOmxldmVsNg0KCXttc28tbGV2ZWwtbnVtYmVyLWZvcm1hdDpi dWxsZXQ7DQoJbXNvLWxldmVsLXRleHQ674KnOw0KCW1zby1sZXZlbC10YWItc3RvcDpub25lOw0K CW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0ZXh0LWluZGVudDotMTguMHB0Ow0K CWZvbnQtZmFtaWx5OldpbmdkaW5nczt9DQpAbGlzdCBsMDpsZXZlbDcNCgl7bXNvLWxldmVsLW51 bWJlci1mb3JtYXQ6YnVsbGV0Ow0KCW1zby1sZXZlbC10ZXh0Ou+CtzsNCgltc28tbGV2ZWwtdGFi LXN0b3A6bm9uZTsNCgltc28tbGV2ZWwtbnVtYmVyLXBvc2l0aW9uOmxlZnQ7DQoJdGV4dC1pbmRl bnQ6LTE4LjBwdDsNCglmb250LWZhbWlseTpTeW1ib2w7fQ0KQGxpc3QgbDA6bGV2ZWw4DQoJe21z by1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwtdGV4dDpvOw0KCW1zby1s ZXZlbC10YWItc3RvcDpub25lOw0KCW1zby1sZXZlbC1udW1iZXItcG9zaXRpb246bGVmdDsNCgl0 ZXh0LWluZGVudDotMTguMHB0Ow0KCWZvbnQtZmFtaWx5OiJDb3VyaWVyIE5ldyI7fQ0KQGxpc3Qg bDA6bGV2ZWw5DQoJe21zby1sZXZlbC1udW1iZXItZm9ybWF0OmJ1bGxldDsNCgltc28tbGV2ZWwt dGV4dDrvgqc7DQoJbXNvLWxldmVsLXRhYi1zdG9wOm5vbmU7DQoJbXNvLWxldmVsLW51bWJlci1w b3NpdGlvbjpsZWZ0Ow0KCXRleHQtaW5kZW50Oi0xOC4wcHQ7DQoJZm9udC1mYW1pbHk6V2luZ2Rp bmdzO30NCm9sDQoJe21hcmdpbi1ib3R0b206MGNtO30NCnVsDQoJe21hcmdpbi1ib3R0b206MGNt O30NCi0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjND MSIgdmxpbms9IiM5NTRGNzIiPg0KPGRpdiBjbGFzcz0iV29yZFNlY3Rpb24xIj4NCjxwIGNsYXNz PSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGUgYXV0aG9ycyBo YXZlIHB1Ymxpc2hlZCBhIG5ldyB2ZXJzaW9uLjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNw OzwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9u dC1zaXplOjExLjBwdCI+QXMgdXN1YWwsIHRoZSBkaWZmIGlzIDxhIGhyZWY9Imh0dHBzOi8vdG9v bHMuaWV0Zi5vcmcvcmZjZGlmZj91cmwyPWRyYWZ0LWlldGYtb3BzZWMtdjYtMTUudHh0Ij4NCmh0 dHBzOi8vdG9vbHMuaWV0Zi5vcmcvcmZjZGlmZj91cmwyPWRyYWZ0LWlldGYtb3BzZWMtdjYtMTUu dHh0PC9hPjxvOnA+PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFu IHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QnV0LCBp dCBjb25zaXN0cyBtYWlubHkgKGJhc2VkIG9uIGNvbW1lbnRzIGZyb20gRmVybmFuZG8gYW5kIG90 aGVycyk6PG86cD48L286cD48L3NwYW4+PC9wPg0KPHVsIHN0eWxlPSJtYXJnaW4tdG9wOjBjbSIg dHlwZT0iZGlzYyI+DQo8bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4t bGVmdDowY207bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij5Tb21lIGNoYW5nZXMgaW4gdGhlIGZsb3cvb3JkZXIgdG8gbWFrZSBpdCBtb3JlIHJl YWRhYmxlICYjNDM7IGZpeGluZyB0eXBvczxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNz PSJNc29MaXN0UGFyYWdyYXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGNtO21zby1saXN0OmwwIGxl dmVsMSBsZm8xIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+UmVmcmVzaCBvZiB0aGUg cmVmZXJlbmNlcyAoSS1EIGJlY29taW5nIFJGQywgb3IgUkZDIG9ic29sZXRpbmcgb3RoZXIgUkZD LCBJRVRGIGlzIGFsaXZlDQo8L3NwYW4+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQ7Zm9u dC1mYW1pbHk6JnF1b3Q7QXBwbGUgQ29sb3IgRW1vamkmcXVvdDsiPiYjMTI4NTIyOzwvc3Bhbj48 c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+KQ0KPG86cD48L286cD48L3NwYW4+PC9saT48 bGkgY2xhc3M9Ik1zb0xpc3RQYXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowY207bXNvLWxp c3Q6bDAgbGV2ZWwxIGxmbzEiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5TZWN0aW9u IDIuMS4yIGFib3V0IFVMQSBpcyBldmVuIHNob3J0ZXIgYW5kIHdlIGhvcGUgZnVsbHkgYWRkcmVz c2VzIHRoZSBjb21tZW50cyByZWNlaXZlZCBhdCBJRVRGLTEwMSBhbmQgSUVURi0xMDI8bzpwPjwv bzpwPjwvc3Bhbj48L2xpPjxsaSBjbGFzcz0iTXNvTGlzdFBhcmFncmFwaCIgc3R5bGU9Im1hcmdp bi1sZWZ0OjBjbTttc28tbGlzdDpsMCBsZXZlbDEgbGZvMSI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPlNhbWUgZm9yIHNlY3Rpb24gMi4xLjQgYWJvdXQgdGVtcG9yYXJ5IGFkZHJlc3Nl czxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdyYXBoIiBzdHls ZT0ibWFyZ2luLWxlZnQ6MGNtO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48c3BhbiBzdHlsZT0i Zm9udC1zaXplOjExLjBwdCI+U2VjdGlvbiAyLjIuMyBtb3JlIHRleHQgdG8gY2xhcmlmeSB0aGUg ZnJhZ21lbnQgaGVhZGVyPG86cD48L286cD48L3NwYW4+PC9saT48bGkgY2xhc3M9Ik1zb0xpc3RQ YXJhZ3JhcGgiIHN0eWxlPSJtYXJnaW4tbGVmdDowY207bXNvLWxpc3Q6bDAgbGV2ZWwxIGxmbzEi PjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5TZWN0aW9uIDIuNiBtZW50aW9uIFNBVkkg bG9nZ2luZyB0byBoZWxwIGZvciBtb25pdG9yaW5nIG9mICZsdDtJUCwgTUFDJmd0OyBhZGRyZXNz ZXMgbWFwcGluZzxvOnA+PC9vOnA+PC9zcGFuPjwvbGk+PGxpIGNsYXNzPSJNc29MaXN0UGFyYWdy YXBoIiBzdHlsZT0ibWFyZ2luLWxlZnQ6MGNtO21zby1saXN0OmwwIGxldmVsMSBsZm8xIj48c3Bh biBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+QWRkZWQgc29tZSB0ZXh0IGluIDIuNy4zIGFib3V0 IHNvbWUgdHJhbnNsYXRpb24gbWVjaGFuaXNtcyBzaGFyaW5nIHNvbWUgaXNzdWVzIHdpdGggQ0dO PG86cD48L286cD48L3NwYW4+PC9saT48L3VsPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4g c3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxw IGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTEuMHB0Ij5UaGUgYXV0 aG9ycyBoYXZlIHJlcXVlc3RlZCBhIHNsb3QgdG8gcHJlc2VudCB0aG9zZSBjaGFuZ2VzIGF0IHRo ZSBPUFNFQyBXRyBtZWV0aW5nIGF0IElFVEYtMTA0IGFzIHdlbGwgYXMgVjZPUFMgKHRvIGNvbGxl Y3QgZmVlZGJhY2svcmV2aWV3cyBmcm9tIG9wZXJhdG9ycykuPG86cD48L286cD48L3NwYW4+PC9w Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6ZToxMS4wcHQiPjxv OnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0 eWxlPSJmb250LXNpemU6MTEuMHB0Ij5BcyB1c3VhbCwgd2Ugd2VsY29tZSBjb21tZW50cyBhbmQg cmV2aWV3cyBlc3AgYmVmb3JlIHRoZSBQcmFndWUgbWVldGluZyBhcyB3ZSB3aWxsIHJlcXVlc3Qg YSBXR0xDIG9uIHRoaXMgZG9jdW1lbnQ8bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86cD4mbmJzcDs8L286 cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImZvbnQtc2l6 ZToxMS4wcHQiPlJlZ2FyZHMsIGZvciB0aGUgYXV0aG9ycyw8bzpwPjwvbzpwPjwvc3Bhbj48L3A+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iZm9udC1zaXplOjExLjBwdCI+PG86 cD4mbmJzcDs8L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5 bGU9ImZvbnQtc2l6ZToxMS4wcHQiPi3DqXJpYyAtbWVyaWtvIC1rayAtZW5ubzxvOnA+PC9vOnA+ PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6 MTEuMHB0Ij48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3A+DQo8L2Rpdj4NCjwvYm9keT4NCjwv aHRtbD4NCg== --_000_88F7F6C827874AE7B344B341DBC08CD2ciscocom_-- From nobody Sat Mar 9 13:55:57 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 498611277D9 for ; Sat, 9 Mar 2019 13:55:55 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2 X-Spam-Level: X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kQBaBN0Krr96 for ; Sat, 9 Mar 2019 13:55:53 -0800 (PST) Received: from mail-pf1-x42b.google.com (mail-pf1-x42b.google.com [IPv6:2607:f8b0:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id BEE8B12705F for ; Sat, 9 Mar 2019 13:55:53 -0800 (PST) Received: by mail-pf1-x42b.google.com with SMTP id n22so790816pfa.3 for ; Sat, 09 Mar 2019 13:55:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-language:content-transfer-encoding; bh=bbn5i8rJZYgo2yp7Di8MI0Dh+/nP4t8oKbc9wRKW7qc=; b=qbD9WmQNeyLwO9OMZuIhnBtAbTulI/VlUHn6EIxnrrT9vLodIz/08LCIm9SzxtRwMR Vp+ALLz+S9nGb+usm14z/B8KoNmjJ6OsrzdbCpCcXfQt/7VBSepoMYN2+tD87OK1dX8H UX2eXz1kU/xFXy4jNOLDu5SLuH+iEeXG9WjanFVBRVo95Eg19zufw+Ss8a5FfX0nporV Fmd9jZFURpsYwuzOf3kX9daB5kQC0U6mG459V5PImitkGPuQ+jDEEYHi3+MXckG5K1nD ovEaEcFeucIgUDX7CTbabZV063PUsGtqDvJDxGMN7IMkv/mAbad6T2mmNe0ghhfNW+1q O9jA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=bbn5i8rJZYgo2yp7Di8MI0Dh+/nP4t8oKbc9wRKW7qc=; b=IpV6l3h0uPBThs7FLyqMNcR514j1XC52UzpTvmYoczKvdlWIfcuz1iSMp1A0PLwmPR Pe6zJM0gbr6BVIwT7Px0dSpu/uT+wNW8kdnoutBeI9eOR6TbKXWkrnodGVd3hTBgdDNV 5Mi4CgcxkcYA1gmEPwGd4ZTpP/moYAnt/ZYs+887VU2+qCJz7BjdvuJdS8iS+PaHY3t5 kwYEvpCPt60nJww+l8sKmRwP7GOtZT1sMvhQjruCKDBf1NTOVaobUIUmwDmWTf90rHH0 BolfMk0qGOS0wuy7SSCgSR+XlQn2A+R+ZjCNeCMTkNYHEPfcEvWAaSqQIwobtle9erFQ 4Dmw== X-Gm-Message-State: APjAAAV2GyUWgtbavIEbqUQkl5dNqwyRXA3CY35OpepufvJMbdQfgBtf o7lNRtdnGbmyCqHQ5S01XGOeQpNR X-Google-Smtp-Source: APXvYqyRxjXxlxjgQdLvhF1hVhP3SvWS7LZoAp+j0K1k6N77TGkBPfrhJjwxfrynygmMhlPFm6Ahcg== X-Received: by 2002:a63:68ca:: with SMTP id d193mr23015360pgc.53.1552168552922; Sat, 09 Mar 2019 13:55:52 -0800 (PST) Received: from [192.168.178.30] (211.231.69.111.dynamic.snap.net.nz. [111.69.231.211]) by smtp.gmail.com with ESMTPSA id f10sm1887376pgo.55.2019.03.09.13.55.50 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 09 Mar 2019 13:55:51 -0800 (PST) To: opsec@ietf.org References: <155216353255.28690.611573903036715612@ietfa.amsl.com> From: Brian E Carpenter Message-ID: Date: Sun, 10 Mar 2019 10:55:49 +1300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.5.3 MIME-Version: 1.0 In-Reply-To: <155216353255.28690.611573903036715612@ietfa.amsl.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-15.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 09 Mar 2019 21:55:55 -0000 Hi, A few comments. (Note that I am not on the opsec list, so please CC me on any replies.) > 2.1.2. Use of ULAs ... > It is tempting to think that ULAs could be useful for infrastructure > hiding as described in [RFC4864];... That's a very strange choice of words, and ignores the actual argument for this choice, which is that internal communications using ULAs are doubly protected from accidental external visibility. If you want to say that RFC4864 was wrong, please argue that explcitly. Otherwise please be neutral, e.g.: ULAs could be used for infrastructure hiding as described in [RFC4864];... > It is recommended to consider filtering packets with ULA source > addresses or ULA destination addresses at the domain boundary. Actually RFC4193 is already stronger than that. Filtering ULA routes is a "must", and filtering packets containing ULA source or destination is a "should" (unless explicitly configured otherwise). I think you should not weaken this here! > 2.1.4. Temporary Addresses - Privacy Extensions for SLAAC > > Historically stateless address autoconfiguration (SLAAC) relies on > the automatically generated EUI-64 address,which together with the > /64 prefix makes up the global unique IPv6 address. That's inaccurate. Try: Historically, stateless address autoconfiguration (SLAAC) relied on an automatically generated 64 bit interface identifier (IID) based on the EUI-64 MAC address, which together with the /64 prefix makes up the globally unique IPv6 address. ... > As [RFC4941] privacy extension addresses could also be used to > obfuscate some malevolent activities (whether on purpose or not), > specific user attribution/accountability procedures must be put in > place as described in section Section 2.6. That "must" is a bit strange. It seems too much to say "MUST", so why not make it "SHOULD"? Regards Brian Carpenter From nobody Sat Mar 9 16:16:49 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3C0321286CD for ; Sat, 9 Mar 2019 16:16:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FsKzD-H9ppHf for ; Sat, 9 Mar 2019 16:16:45 -0800 (PST) Received: from mail-wr1-x42b.google.com (mail-wr1-x42b.google.com [IPv6:2a00:1450:4864:20::42b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 33658127917 for ; Sat, 9 Mar 2019 16:16:45 -0800 (PST) Received: by mail-wr1-x42b.google.com with SMTP id f14so1266372wrg.1 for ; Sat, 09 Mar 2019 16:16:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=RK9tV8XvJfyOGNRk8inain5Rd4AXPB/KI3J3N4MS/UM=; b=Fj7ukqFbbGZCXEFozLbfp2Y4zMkQijSVlYaNBH++880aa3mlGszX7PvgKiNWJai3s5 efyJN1uR7HJ5sG/mFkdiowX903C7RdzBJy8nri9mkahL+FyFiPsqujoR4RU2x1GFMHWc CGqq8niEs+H3MyK2uQc5nTaX8nPnxwYFv9fqnVHITId02ISHdKHTKI0YRNUY0l83TP2W qS4WUE1N+lZBGr38UqmCiHQF/pPpCa+n7Q7+4qoolZgGXllT7UGc46w8orMh7waZ/y5z oR+FYQHjwWlRMZBVFOkYKuj9sO8VT8lFx1me0QRz7nXr+VchGebQbNBtGUddeNdrRBHA hz/Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=RK9tV8XvJfyOGNRk8inain5Rd4AXPB/KI3J3N4MS/UM=; b=kszRRpcRZjMFE+dP3yIJigfIAyblonhA0o/OiI2AlAfT9BNLP1Tyfx0jkSIExbX3TN 76zNVbxSwrhsegJba5MZnTAIlUs2+tRwWkttJs7N11EG0yWdG+UjcdeP6wISF1UDtsbI tB+LpsLkR0oBgmWGhG9cXYyTKNJfsAHdoYq5/don7fUCFu/jG3ra8Bane+x/+LpzOjBZ je048Iq1olhXO0jO5LquNoG+1bvH3TJ5qMDYYjkKvxsMzIDYB9eOfqVXLEFzPSu5/8I3 DxzJ5YjGV/U6FbT3varb/2e+TnpYDc4/jbRUJccUkNbc5Y7gvri7Wd0jaKotktiSTEpa 5qgw== X-Gm-Message-State: APjAAAUbUdm2mIp4OK0wWBzcwKsoRo2xS+zUqT4fFUPFgZVE8lITagAM Xy0V2BAXo11OnZCaMfTlqqI= X-Google-Smtp-Source: APXvYqyg7qGKmvvMhYZvAw75WfdViI8UZ0/Ck4SlcxaLKjvBANG6ewzHLknDPYsnvuryvS3flwYAiw== X-Received: by 2002:a5d:6112:: with SMTP id v18mr15220981wrt.207.1552177003605; Sat, 09 Mar 2019 16:16:43 -0800 (PST) Received: from [192.168.0.47] (141-126-104-249.dhcp.chtrptr.net. [141.126.104.249]) by smtp.gmail.com with ESMTPSA id s5sm2090011wra.77.2019.03.09.16.16.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 09 Mar 2019 16:16:42 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Bob Hinden In-Reply-To: Date: Sat, 9 Mar 2019 16:16:39 -0800 Cc: Bob Hinden , opsec@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <155216353255.28690.611573903036715612@ietfa.amsl.com> To: Brian Carpenter X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-15.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 00:16:47 -0000 Brian, > On Mar 9, 2019, at 1:55 PM, Brian E Carpenter = wrote: >=20 > Hi, >=20 > A few comments. (Note that I am not on the opsec list, so please CC me = on any replies.) >=20 >> 2.1.2. Use of ULAs > .... >> It is tempting to think that ULAs could be useful for infrastructure >> hiding as described in [RFC4864];... >=20 > That's a very strange choice of words, and ignores the actual argument > for this choice, which is that internal communications using ULAs > are doubly protected from accidental external visibility. If you want > to say that RFC4864 was wrong, please argue that explcitly. Otherwise > please be neutral, e.g.: >=20 > ULAs could be used for infrastructure hiding as described in = [RFC4864];=E2=80=A6 +1 >=20 >> It is recommended to consider filtering packets with ULA source=09 >> addresses or ULA destination addresses at the domain boundary. >=20 > Actually RFC4193 is already stronger than that. Filtering ULA routes > is a "must", and filtering packets containing ULA source or = destination > is a "should" (unless explicitly configured otherwise). I think you > should not weaken this here! RFC4864 also describes this. Bob >=20 >> 2.1.4. Temporary Addresses - Privacy Extensions for SLAAC >>=20 >> Historically stateless address autoconfiguration (SLAAC) relies on=09 >> the automatically generated EUI-64 address,which together with the=09 >> /64 prefix makes up the global unique IPv6 address. >=20 > That's inaccurate. Try: >=20 > Historically, stateless address autoconfiguration (SLAAC) relied on=09 > an automatically generated 64 bit interface identifier (IID) based > on the EUI-64 MAC address, which together with the /64 prefix makes > up the globally unique IPv6 address. >=20 > .... >> As [RFC4941] privacy extension addresses could also be used to >> obfuscate some malevolent activities (whether on purpose or not), >> specific user attribution/accountability procedures must be put in >> place as described in section Section 2.6. >=20 > That "must" is a bit strange. It seems too much to say "MUST", > so why not make it "SHOULD"? >=20 > Regards > Brian Carpenter >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec From nobody Sun Mar 10 12:50:03 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73AA7127990 for ; Sun, 10 Mar 2019 12:50:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.234 X-Spam-Level: X-Spam-Status: No, score=-1.234 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, KHOP_DYNAMIC=1.468, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=juniper.net Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YZDlcPAvR6oM for ; Sun, 10 Mar 2019 12:50:01 -0700 (PDT) Received: from mx0b-00273201.pphosted.com (mx0b-00273201.pphosted.com [67.231.152.164]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ED253127985 for ; Sun, 10 Mar 2019 12:50:00 -0700 (PDT) Received: from pps.filterd (m0108161.ppops.net [127.0.0.1]) by mx0b-00273201.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x2AJn9Dm032346 for ; Sun, 10 Mar 2019 12:50:00 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=juniper.net; h=from : to : subject : date : message-id : content-type : content-transfer-encoding : mime-version; s=PPS1017; bh=b0sgvStG1ieAeF9acDsgPjDh5baCvnxB+yfzFZ54riI=; b=lf5zVvkqeHxYgsV1H8/i4rbZk3fplqQrbh+tvu5Vbb0Sg0DlQQ4Zr/q6IRX0uWr1C8dX QCkzZJwhwiijouu4eps3lOYfkvaOCgMjaiqMDC+nG+/9qeC5bujBq9f+ygj4X5lYoZus wRaZJv5ZhKcrEPDd2lCde07KxP8shLh0daD+HkdK781jJHFRc3kfbtJgEJrOJWH1p6QD 5PQouzTfcE/c4Qnnzj/nGxzQe6QUXXPgF4YtSm3jwlJvkS4/lW0/yupM8VPAuLg+53tx IUnqG7X2xkbDV8QeF2wrLOjoDJ6EP946KKz5MNKR00EyCHc1tcNar6JFX8LhDWXpUUhw kg== Received: from nam03-by2-obe.outbound.protection.outlook.com (mail-by2nam03lp2056.outbound.protection.outlook.com [104.47.42.56]) by mx0b-00273201.pphosted.com with ESMTP id 2r4dg2hnp3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Sun, 10 Mar 2019 12:49:59 -0700 Received: from BYAPR05MB4245.namprd05.prod.outlook.com (20.176.252.26) by BYAPR05MB5351.namprd05.prod.outlook.com (20.177.127.160) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.9; Sun, 10 Mar 2019 19:49:56 +0000 Received: from BYAPR05MB4245.namprd05.prod.outlook.com ([fe80::3937:23f4:f61c:a2f8]) by BYAPR05MB4245.namprd05.prod.outlook.com ([fe80::3937:23f4:f61c:a2f8%5]) with mapi id 15.20.1709.011; Sun, 10 Mar 2019 19:49:56 +0000 From: Ron Bonica To: "opsec@ietf.org" Thread-Topic: IETF 104 Thread-Index: AdTXehyZuXjaXgwiSQWOKBlUMY36Zw== Date: Sun, 10 Mar 2019 19:49:56 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.1.100.23 dlp-reaction: no-action x-originating-ip: [66.129.241.14] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 7c5e6d36-d321-4524-73c9-08d6a59192b1 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(4618075)(2017052603328)(7153060)(7193020); SRVR:BYAPR05MB5351; x-ms-traffictypediagnostic: BYAPR05MB5351: x-microsoft-antispam-prvs: x-forefront-prvs: 0972DEC1D9 x-forefront-antispam-report: SFV:NSPM; SFS:(10019020)(346002)(376002)(366004)(396003)(136003)(39860400002)(199004)(189003)(478600001)(99286004)(26005)(81166006)(2501003)(6346003)(2906002)(66066001)(102836004)(33656002)(8936002)(53936002)(7696005)(52536013)(6506007)(71190400001)(86362001)(71200400001)(25786009)(5660300002)(9686003)(97736004)(68736007)(14454004)(5640700003)(7736002)(105586002)(2351001)(106356001)(486006)(55016002)(7116003)(6436002)(476003)(81156014)(6116002)(8676002)(1730700003)(3846002)(74316002)(305945005)(316002)(558084003)(6916009)(256004)(186003); DIR:OUT; SFP:1102; SCL:1; SRVR:BYAPR05MB5351; H:BYAPR05MB4245.namprd05.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: juniper.net does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: +ZsfdCoWE6ElN8VKKYwtkhMMv+9kBHO06wI4gKpkqQnXUuVeU1F0xbvHg2/EvWsatUj7eukw4JOpyWUrB9Yp7lfW4h/awIsJDPOvxIDcFdMfQMi4OxUFeMcrnm/bsaxBVi41acOkicn+anZABLF0m0fooXBBGFwpu8Fe9WFzJbPhqQEX+NQrejfUfka514u2IF7Qi9N9KdRIAjeZ2xnulAb6eosfQdfZkMNHxJ3cO3DNNbDzEQCGWsg/YSfHGRIPb3UkESJjlLGjtaWlE79epOxO+DmjXCXm6TedHj7Du29w9BfEmS5+M0Fc2RC8hLo200dQK/x2HPkvBVbANnZOr5TSUGYVOTCS3tQArmqKtsGa6LKtaChADWS54H7fPp0eef+2ngKn+uBxYjfTBB4v++aqfubvJE2yZtxSrbcZ27Q= Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-Network-Message-Id: 7c5e6d36-d321-4524-73c9-08d6a59192b1 X-MS-Exchange-CrossTenant-originalarrivaltime: 10 Mar 2019 19:49:56.8106 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR05MB5351 X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:, , definitions=2019-03-10_18:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_spam_notspam policy=outbound_spam score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=595 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1810050000 definitions=main-1903100154 Archived-At: Subject: [OPSEC] IETF 104 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 10 Mar 2019 19:50:03 -0000 Folks, So far, we have only one item on the agenda for our meeting at IETF 104. So= , in preparation for the meeting, please review draft-ietf-opsec-v6. The meeting will be short.=20 Could we have volunteers to take minutes and jabber scribe? Eric and Ron From nobody Mon Mar 11 01:38:55 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D9CFE1310BE for ; Mon, 11 Mar 2019 01:38:53 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.299 X-Spam-Level: X-Spam-Status: No, score=-4.299 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, TVD_SPACE_RATIO=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=ericsson.com header.b=CRx6foBe; dkim=pass (1024-bit key) header.d=ericsson.com header.b=faN5b1my Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t9oZYxjizJAS for ; Mon, 11 Mar 2019 01:38:52 -0700 (PDT) Received: from sessmg23.ericsson.net (sessmg23.ericsson.net [193.180.251.45]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 10DE11277D7 for ; Mon, 11 Mar 2019 01:38:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; d=ericsson.com; s=mailgw201801; c=relaxed/relaxed; q=dns/txt; i=@ericsson.com; t=1552293527; x=1554885527; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version:Content-Type: Content-Transfer-Encoding:Content-ID:Content-Description:Resent-Date:Resent-From: Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=PpPudPnJNDa3VWIlL5AFCD5dCXXE49EEcMKZKMQkXyY=; b=CRx6foBeXQX5caLGxOa1H5TtrCdLFZDUIikFklVTmw+xvltRu8ple7igbkdLX8pz /XBZTt6esSBss0eril21OnUu2ez4v8bhroxSxpv5eFGXYt2zu5wg42kxBj41T2+5 RccXPQXPzaYRM0xsQAtiH0llzqwlbIVRPdbNaVkj/oQ=; X-AuditID: c1b4fb2d-2198b9e00000062f-26-5c861e979318 Received: from ESESBMB501.ericsson.se (Unknown_Domain [153.88.183.114]) by sessmg23.ericsson.net (Symantec Mail Security) with SMTP id D0.8F.01583.79E168C5; Mon, 11 Mar 2019 09:38:47 +0100 (CET) Received: from ESESSMR503.ericsson.se (153.88.183.112) by ESESBMB501.ericsson.se (153.88.183.114) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Mon, 11 Mar 2019 09:38:39 +0100 Received: from ESESSMB503.ericsson.se (153.88.183.164) by ESESSMR503.ericsson.se (153.88.183.112) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3; Mon, 11 Mar 2019 09:38:40 +0100 Received: from EUR01-VE1-obe.outbound.protection.outlook.com (153.88.183.157) by ESESSMB503.ericsson.se (153.88.183.164) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1466.3 via Frontend Transport; Mon, 11 Mar 2019 09:38:39 +0100 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ericsson.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PpPudPnJNDa3VWIlL5AFCD5dCXXE49EEcMKZKMQkXyY=; b=faN5b1myiVFbU/bd5V6muCWN94zu9H3xIQF1VIaOcrn41Hfztmbc0eRqBx9QiaLR5uFWWSUbtlMyvbXmqXxaIaSNy0TrNXPxW15/u5N15wVjX2NfVVjEzda4xvpP9zMC7WotGzYrKvuNFQ1XZxR/MVWIM0nxuAaDaTEX5X8Meuc= Received: from AM0PR07MB5668.eurprd07.prod.outlook.com (20.178.115.202) by AM0PR07MB5697.eurprd07.prod.outlook.com (20.178.113.93) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1709.9; Mon, 11 Mar 2019 08:38:39 +0000 Received: from AM0PR07MB5668.eurprd07.prod.outlook.com ([fe80::7506:19b:f358:a6ae]) by AM0PR07MB5668.eurprd07.prod.outlook.com ([fe80::7506:19b:f358:a6ae%5]) with mapi id 15.20.1709.011; Mon, 11 Mar 2019 08:38:39 +0000 From: Pierre Lin To: "OPSEC@ietf.org" Thread-Topic: unsubscribe Thread-Index: AdTX5cVZB7ZhihCPTKWGRyoGv4fLcQ== Date: Mon, 11 Mar 2019 08:38:38 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=pierre.lin@ericsson.com; x-originating-ip: [59.124.88.153] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: e78e51c4-05f4-4941-3b74-08d6a5fcf59a x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600127)(711020)(4605104)(2017052603328)(7153060)(7193020); SRVR:AM0PR07MB5697; x-ms-traffictypediagnostic: AM0PR07MB5697: x-microsoft-antispam-prvs: x-forefront-prvs: 09730BD177 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(39860400002)(136003)(396003)(346002)(366004)(376002)(199004)(189003)(7696005)(316002)(790700001)(3846002)(6116002)(3480700005)(486006)(478600001)(99286004)(2501003)(71200400001)(4270600006)(68736007)(7736002)(86362001)(44832011)(74316002)(52536013)(71190400001)(7116003)(186003)(236005)(2351001)(55016002)(81156014)(105586002)(54896002)(106356001)(9686003)(6306002)(256004)(25786009)(53936002)(5660300002)(81166006)(476003)(26005)(102836004)(5640700003)(97736004)(558084003)(2906002)(14454004)(33656002)(6436002)(66066001)(8936002)(6916009)(8676002)(6506007)(221733001)(166393002)(220243001); DIR:OUT; SFP:1101; SCL:1; SRVR:AM0PR07MB5697; H:AM0PR07MB5668.eurprd07.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: ericsson.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: 3K3TBRChU3T0Wi6mA1SOqrsHAvOhP7rfJLlojhSn098IkUVhHWc37yj+xlDiPmhNBTuEdn7b789EO1w0sF3hjDkz5aiJrndvHzdsshBJXhQCm8dcEZ+rzhsR/FvF1hnfUvBu6bKx8NXU8lrIZbMtEu7blnI2pWr3ucqBxWaXjH+BNJzPo7UbVgu5t6eulLBRDaR+I7enHwxeF/3tt/lt3VhtGUlDbfTri6LizG6u5QCEelk7/ewDIF7E7ZcIgNR8zQCpj3Fc8QSnsQMeFyL6BP+ij24tAs8n52lqJ1byFJYTKRUWR6KfSq6QzkNchJOe1tNnLmvbuE6HA9BvRz9PYzr6lw+BGvTYISxdVVCNFHrVLspzqHYg0p8ohbo2n3xcNKSYMZ11uz8GnqkctjxoJubIrv45upPbCNHQKQ2lFzE= Content-Type: multipart/alternative; boundary="_000_AM0PR07MB56682469B41B883B21188378F5480AM0PR07MB5668eurp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: e78e51c4-05f4-4941-3b74-08d6a5fcf59a X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Mar 2019 08:38:38.8669 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 92e84ceb-fbfd-47ab-be52-080c6b87953f X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR07MB5697 X-OriginatorOrg: ericsson.com X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrAKsWRmVeSWpSXmKPExsUyM2J7ke50ubYYg0udXBYftt5lc2D0WLLk J1MAYxSXTUpqTmZZapG+XQJXRs/762wFT0Qqzp9/ztzAeFioi5GTQ0LARGLLgQ7GLkYuDiGB I4wSN9+cY4FwvjFKfNzbyQbntN7eyAbSIiSwhElic4sXSIJFYAKzxIbl3cwQVZOZJPbvfMwO 4TxglNhxdhMrSAubgJbEzOZ7YLaIgKrEufttzCC2sICIxP4954BsDqC4pMTmM4wQJXoSqw6u YgexWYDKj27cxQRi8wrESHztnAsWZxQQk/h+ag1YnFlAXOLWk/lMEA8JSCzZc54ZwhaVePn4 HytEfZTEvjU/WCHiihJtT1azQ9iyEpfmdzNC2L4Sm6d2soLcLyFwk1Fixrx+qCItiQ9Pm6GK siXOrHsANUhGYtbsB1A1XWwSzRPdIUGUKrF8bStUvZzEqt6HLBBDzzNLzJj1jBHi6nyJb437 mScwas5C8sQsJKlZYE8LSpyc+YQFIq4jsWD3JzYIW1ti2cLXzDD2mQOPmZDFFzCyr2IULU4t Ls5NNzLWSy3KTC4uzs/Ty0st2cQITDcHt/zW3cG4+rXjIUYBDkYlHl7Nj60xQqyJZcWVuYcY JTiYlUR4E2TbYoR4UxIrq1KL8uOLSnNSiw8xSnOwKInz/hESjBESSE8sSc1OTS1ILYLJMnFw SjUwzjk+LW7iA5e6/bqcN+/c4orKP/WaPeHTYav4Y7N3XpJRXpsYzFpxyM7vTemsmztFzX0E 25c1H72xayLj46YT66u+nNSWZwm4YO3gwtXxbof6vC0J57XWncos3WM7t8vs41WpZw/vPlzX c/r8bhNZVpUX4fOjXltV6zquT2TQTI2fdvTsoqQmKSWW4oxEQy3mouJEAIpOmRgzAwAA Archived-At: Subject: [OPSEC] unsubscribe X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 08:38:54 -0000 --_000_AM0PR07MB56682469B41B883B21188378F5480AM0PR07MB5668eurp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Unsubscribe pierre.lin@ericsson.com --_000_AM0PR07MB56682469B41B883B21188378F5480AM0PR07MB5668eurp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Unsubscribe pierre.lin@ericsson.com=

 

--_000_AM0PR07MB56682469B41B883B21188378F5480AM0PR07MB5668eurp_-- From nobody Mon Mar 11 01:44:50 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 146481310BF for ; Mon, 11 Mar 2019 01:44:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -14.501 X-Spam-Level: X-Spam-Status: No, score=-14.501 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=M7As2hD0; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=QAPkFXPG Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LM3w_k_pd_Xb for ; Mon, 11 Mar 2019 01:44:47 -0700 (PDT) Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com [173.37.86.78]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 675461310F8 for ; Mon, 11 Mar 2019 01:44:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=3900; q=dns/txt; s=iport; t=1552293887; x=1553503487; h=from:to:subject:date:message-id:references:in-reply-to: content-id:content-transfer-encoding:mime-version; bh=Fc9IL4HOUBkiAQnQoLk2APGap5OzmYVndhli+8DZCVA=; b=M7As2hD0632P9pO66OGVdHOBH+7qTvkNxJX04t5Fx4/ZL470Jbe6UbJW 4rGkIMt6tkUP12LatEG4uCsVuzDd4IHaSJsr7mqTn1nHCI8jQ0D2oKuD6 1pEEgp8Wc0PIL9VS1Ph2uXe/DYSIhBwqlYUoR7ECLDjgobkHkft9VIUTB g=; IronPort-PHdr: =?us-ascii?q?9a23=3AeupPbBboE1QSoxMZwtczic3/LSx94ef9IxIV55?= =?us-ascii?q?w7irlHbqWk+dH4MVfC4el20gebRp3VvvRDjeee87vtX2AN+96giDgDa9QNMn?= =?us-ascii?q?1NksAKh0olCc+BB1f8KavncT08F8dPfFRk5Hq8d0NSHZW2ag=3D=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0BAAACTH4Zc/5hdJa1kHAEBAQQBAQc?= =?us-ascii?q?EAQGBUgYBAQsBgTwpJwNodAQLJ4QJg0cDjzRKgg2JMY51gSQDVAsBARgLCYR?= =?us-ascii?q?AAheEIiI1CA0BAQMBAQcBAwJtHAyFSwEBAwEBASERDAEBLAwPAgEIGgImAgI?= =?us-ascii?q?CHwYLFRACBAESgyIBgV0DDQgBAgyjcwKKFHGBL4J4AQEFgkaCNA0LggwDBYE?= =?us-ascii?q?LJAGLLBeBQD+BEScfgkyCV0cBAYFhF4JzMYImikuCApckMwkCi0uEAYM+GYF?= =?us-ascii?q?5hWaCRIkXiniHFosxAgQCBAUCDgEBBYFJATWBVnAVOyoBgkGCCgwXgQABCIJ?= =?us-ascii?q?ChRSFP3IBgSeMRyqCIwEB?= X-IronPort-AV: E=Sophos;i="5.58,467,1544486400"; d="scan'208";a="530168755" Received: from rcdn-core-1.cisco.com ([173.37.93.152]) by rcdn-iport-7.cisco.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Mar 2019 08:44:43 +0000 Received: from XCH-RCD-006.cisco.com (xch-rcd-006.cisco.com [173.37.102.16]) by rcdn-core-1.cisco.com (8.15.2/8.15.2) with ESMTPS id x2B8ihSn002026 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=FAIL); Mon, 11 Mar 2019 08:44:43 GMT Received: from xhs-rcd-002.cisco.com (173.37.227.247) by XCH-RCD-006.cisco.com (173.37.102.16) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 11 Mar 2019 03:44:42 -0500 Received: from xhs-rcd-001.cisco.com (173.37.227.246) by xhs-rcd-002.cisco.com (173.37.227.247) with Microsoft SMTP Server (TLS) id 15.0.1473.3; Mon, 11 Mar 2019 03:44:41 -0500 Received: from NAM01-BN3-obe.outbound.protection.outlook.com (72.163.14.9) by xhs-rcd-001.cisco.com (173.37.227.246) with Microsoft SMTP Server (TLS) id 15.0.1473.3 via Frontend Transport; Mon, 11 Mar 2019 03:44:41 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector1-cisco-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Fc9IL4HOUBkiAQnQoLk2APGap5OzmYVndhli+8DZCVA=; b=QAPkFXPG7v/0e4oz2C9mRqIkDEA3qFtBIJnQcZ07ZdDXDMcRmviRmVZ7oWhe5BhCu/7zzexcnTcVmTPtECYXprqi6DrYCsgr8ni6nlk6OZXVFsr5xfUpLf+vd5qW+tkgAcQL9Dt+9YKr3LyeI9VVIKHUXXyr5/azC65AIDjtkw4= Received: from DM6PR11MB3820.namprd11.prod.outlook.com (20.179.17.28) by DM6PR11MB2841.namprd11.prod.outlook.com (20.176.100.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.1686.19; Mon, 11 Mar 2019 08:44:41 +0000 Received: from DM6PR11MB3820.namprd11.prod.outlook.com ([fe80::e5ab:9e18:b14c:9b9c]) by DM6PR11MB3820.namprd11.prod.outlook.com ([fe80::e5ab:9e18:b14c:9b9c%5]) with mapi id 15.20.1686.021; Mon, 11 Mar 2019 08:44:41 +0000 From: "Eric Vyncke (evyncke)" To: Brian E Carpenter , "opsec@ietf.org" Thread-Topic: [OPSEC] I-D Action: draft-ietf-opsec-v6-15.txt Thread-Index: AQHU1sLzpT2aeYvj+EyB2crrw1NFzaYGGK2A Date: Mon, 11 Mar 2019 08:44:40 +0000 Message-ID: References: <155216353255.28690.611573903036715612@ietfa.amsl.com> In-Reply-To: Accept-Language: fr-BE, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/10.15.0.190117 authentication-results: spf=none (sender IP is ) smtp.mailfrom=evyncke@cisco.com; x-originating-ip: [2001:420:c0c0:1007::21d] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: b7caa803-e860-49e1-2eb1-08d6a5fdcd60 x-microsoft-antispam: BCL:0; PCL:0; RULEID:(2390118)(7020095)(4652040)(8989299)(5600127)(711020)(4605104)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(2017052603328)(7153060)(7193020); SRVR:DM6PR11MB2841; x-ms-traffictypediagnostic: DM6PR11MB2841: x-ms-exchange-purlcount: 1 x-microsoft-exchange-diagnostics: =?utf-8?B?MTtETTZQUjExTUIyODQxOzIzOjlwS1hDeFFvVHpuVFNIeGZTZmJBWlE3TlJ0?= =?utf-8?B?ZVNpTGFPS2NZckxETXpBZVVmdElzLzA3UDhEVzNOODMrR0pubjA0VHJRZXRn?= =?utf-8?B?Z09vdHBBYU13SmZyU1hBU2RiREsvVTYxdEUxRkQ4YkUzQ1M5djhDMnpWRW1D?= =?utf-8?B?NTlzK0lBVXFUcmlmVldyY2ZlUzB6RGpFWloybXFQT1IxcnZNR1hSbEtRYnFk?= =?utf-8?B?MUdIdmg5N2NYbnlWMksrTXdMNG40aG1Ic2RTS0RJdjJ6SytIQnZkSldwMlJl?= =?utf-8?B?clJwbjhYWXQwRUh1MndUbkU4RGJMamVLbEpHck1Uc1ZyV2ZlY1N5OE5aWEJD?= =?utf-8?B?VnpPOHB2NW9PNWtzc0xsOVlEZkFRUWprVnpxcUF2VmM5aHh0YmtwSU9NNjNQ?= =?utf-8?B?dzMwK3BrQlQ0T2E3cHVOdCtqSjZzUENlNHlVZ2craHRwbG02dk8wdk0zYThl?= =?utf-8?B?SUFzNTR2NGNLZG5QdnlDc2FvR2VtR0pTa0lCNU1zWjVnSm5lN1cva240UUU5?= =?utf-8?B?RVNRYUZOdWhjTkl3MlVrY2xnaXFkRFA1MnhLYlF2ejh0dWRaSDdKcUVDbm0x?= =?utf-8?B?cEQ2Nmw0R05rcWtjZVNGUWRsOXBZcmtOUHFaUFhjdGpWelNxTTJoNGduWit5?= =?utf-8?B?amcrT2pUbEZDWGdJU2Ntc1RNdXBQWVRPeG5semdHQjI4cWU5eGUrY3NRa3o5?= =?utf-8?B?RDJpMDN2SUxNVGs5ZnZ0NFFFaUVTeE1aRzN5L2lyOEZ6QVR4S0o2TEMrNnJ1?= =?utf-8?B?SnZGbmdSTFQzYjE3UFJVQUxROHcxTWVOR203eXllc0tZQUxFR2FzK2t1ZGNw?= =?utf-8?B?ZWVqMzZROExNblBBaklId3Jzc0t1dTh0SGZ1R08vaC9vemt6RjMzSWxEMEoy?= =?utf-8?B?SWl4U2k5dkFQNVVXVTVDZmJnRHU3d2ZYc0NDWjFISkR3bkE2S21DVjRmcnlZ?= =?utf-8?B?NUZSK0xJS2FJNThyMis4NXVwa0xLemlxWUhRRE9CdklBY2FWT3FVRkxIa3dV?= =?utf-8?B?YXZHZG5XY3NZbTRUMkNrOE5iZVhQR0w1VW1WUnZhaE03cEhBVFBqQ1pqU1NS?= =?utf-8?B?ME90OW14L1E3Y1BONk5OYlBFNm4vNVRQMkhWeCtZNkcyRkNuYkNzYkhJQ2pE?= =?utf-8?B?QnRWeC9DVElYUTVZeWVDWkxnZTd4b3pLVjdFZ1UzVXRHbngzMlNYK3BLU2Zx?= =?utf-8?B?NU1lZDQxTkF5Z2lNdnBFMFk0alllL1VDM2pCdmp6WjF5azEwOU0ram55Y0tz?= =?utf-8?B?cVhOOXVQK0ZmM28vRVpxSXN6eUpIenViVjhhN2VGSFE4SDQvTjZkcCsrSitB?= =?utf-8?B?QXJvZjYva3NMZkFVNFpmNEt5dTI1TG1KclNVZ3NucEdoVWRpeTZZc0JkcmVl?= =?utf-8?B?Vngxd2JyWmxTNHJYNWRMcm9uT3NETC9yM1A2U1grZW9PV2JCZEwrb2t4bk1k?= =?utf-8?B?QzdmdURVWDJiUndYUjB0MUJ0RGd2NGVnTTNwV0luQVB5akFjT2FUZ1RQVlJB?= =?utf-8?B?ckt2bTd0eTZjRlk1aVZJQzRRVHYrSE9pUGV3MVlyRi9MeVlqSFFvZEZxREZY?= =?utf-8?B?cGYzajhqQWh1NVhkeWNkZzFxcytmUUVpNHZ4QkJaTHFhaDkwR1JlcEo1Sjh6?= =?utf-8?B?dkR6V2JsREJ3eHQ1blFWV2ZRN3V6RVpPbHpoME9SV2FQYnZKaTQ2UXY3NXo4?= =?utf-8?Q?vfL7/hBiYhDaN5c+B4=3D?= x-microsoft-antispam-prvs: x-forefront-prvs: 09730BD177 x-forefront-antispam-report: SFV:NSPM; SFS:(10009020)(136003)(396003)(366004)(39860400002)(376002)(346002)(199004)(189003)(11346002)(36756003)(2906002)(83716004)(86362001)(110136005)(476003)(446003)(2616005)(46003)(256004)(82746002)(14444005)(8936002)(58126008)(97736004)(486006)(316002)(229853002)(186003)(6486002)(68736007)(25786009)(6436002)(6116002)(106356001)(71200400001)(305945005)(6512007)(6306002)(7736002)(5660300002)(102836004)(2501003)(76176011)(14454004)(966005)(33656002)(8676002)(6246003)(99286004)(53936002)(81156014)(81166006)(478600001)(105586002)(6506007)(71190400001); DIR:OUT; SFP:1101; SCL:1; SRVR:DM6PR11MB2841; H:DM6PR11MB3820.namprd11.prod.outlook.com; FPR:; SPF:None; LANG:en; PTR:InfoNoRecords; A:1; MX:1; received-spf: None (protection.outlook.com: cisco.com does not designate permitted sender hosts) x-ms-exchange-senderadcheck: 1 x-microsoft-antispam-message-info: ko1y3PTjCF6RN2PT8d11hURm8/FenW887vaTJeV+ag2csKtSG3NmuUttnD8bTRvuwzPvRdQ3YO3HbbBciWGJX/r/MEjaG9lw+Okp//igZC1MLaqyLKH7IGpPu+RM1bQpqPNtKrIfD8kknlGkQTNPjUZP6cpOLaWmmqlpVtEu/1dOmENH1knO7NYZOYGsfHRCVMq0wxt87LO8vf6yqqT6u2qprni6fB5cGMO/nAzI0d/GbX3TLCduPuFkTl9Fr7L79LyOfFP8SYtEtoQrVYqLbIUbiwS2y97ZqILV7T75gnK0EBa5r5ViSDNLOL7P0RNcpsOq2DTzmbjyjyCXtsEsaJMj3FID8wMwpnbg41vJKI7iViVeE95CarvU6zyudbg5poB/bI8MpeodBuP/IQkeGszZA3wwZY8kP0TAKGPVu2Q= Content-Type: text/plain; charset="utf-8" Content-ID: <631997ACDA561F4E8872A928511992E2@namprd11.prod.outlook.com> Content-Transfer-Encoding: base64 MIME-Version: 1.0 X-MS-Exchange-CrossTenant-Network-Message-Id: b7caa803-e860-49e1-2eb1-08d6a5fdcd60 X-MS-Exchange-CrossTenant-originalarrivaltime: 11 Mar 2019 08:44:40.7653 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB2841 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.37.102.16, xch-rcd-006.cisco.com X-Outbound-Node: rcdn-core-1.cisco.com Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-15.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 08:44:49 -0000 QnJpYW4gYW5kIEJvYiwNCg0KRmlyc3Qgb2YgYWxsLCB0aGFuayB5b3UgZm9yIHRoZSBxdWljayBy ZXZpZXcuIEFuZCBlc3BlY2lhbGx5LCB0aGUgdGV4dCBhcm91bmQgRVVJLTY0ICYgU0xBQUMgd2hp Y2ggd2UsIHRoZSBhdXRob3JzLCB3aWxsIGdsYWRseSBhY2NlcHQuDQoNCkluIG9yZGVyIHRvIHBy b2dyZXNzIHdpdGggdGhpcyBkcmFmdCwgdGhlIGF1dGhvcnMgd2lsbCBpc3N1ZSB0b2RheSBhIC0x NiB3aGVyZSB0aGUgVUxBIHNlY3Rpb24gd2lsbCBzaW1wbHkgYmUgcmVkdWNlZCB0byBtZW50aW9u IHRoZSBVTEEgY29uc2lkZXJhdGlvbnMgZHJhZnQuIFdpdGggdGhpcywgd2UgaG9wZSB0byByZW1v dmUgdGhlIGxhc3QgKD8pIGJsb2NraW5nIGZhY3RvciBmb3IgdGhpcyBPUHNlY3Y2IGRyYWZ0Lg0K DQpSZWdhcmRzDQoNCi3DqXJpYw0KDQrvu79PbiAwOS8wMy8yMDE5LCAyMjo1NiwgIk9QU0VDIG9u IGJlaGFsZiBvZiBCcmlhbiBFIENhcnBlbnRlciIgPG9wc2VjLWJvdW5jZXNAaWV0Zi5vcmcgb24g YmVoYWxmIG9mIGJyaWFuLmUuY2FycGVudGVyQGdtYWlsLmNvbT4gd3JvdGU6DQoNCiAgICBIaSwN CiAgICANCiAgICBBIGZldyBjb21tZW50cy4gKE5vdGUgdGhhdCBJIGFtIG5vdCBvbiB0aGUgb3Bz ZWMgbGlzdCwgc28gcGxlYXNlIENDIG1lIG9uIGFueSByZXBsaWVzLikNCiAgICANCiAgICA+IDIu MS4yLiBVc2Ugb2YgVUxBcw0KICAgIC4uLi4NCiAgICA+IEl0IGlzIHRlbXB0aW5nIHRvIHRoaW5r IHRoYXQgVUxBcyBjb3VsZCBiZSB1c2VmdWwgZm9yIGluZnJhc3RydWN0dXJlDQogICAgPiBoaWRp bmcgYXMgZGVzY3JpYmVkIGluIFtSRkM0ODY0XTsuLi4NCiAgICANCiAgICBUaGF0J3MgYSB2ZXJ5 IHN0cmFuZ2UgY2hvaWNlIG9mIHdvcmRzLCBhbmQgaWdub3JlcyB0aGUgYWN0dWFsIGFyZ3VtZW50 DQogICAgZm9yIHRoaXMgY2hvaWNlLCB3aGljaCBpcyB0aGF0IGludGVybmFsIGNvbW11bmljYXRp b25zIHVzaW5nIFVMQXMNCiAgICBhcmUgZG91Ymx5IHByb3RlY3RlZCBmcm9tIGFjY2lkZW50YWwg ZXh0ZXJuYWwgdmlzaWJpbGl0eS4gSWYgeW91IHdhbnQNCiAgICB0byBzYXkgdGhhdCBSRkM0ODY0 IHdhcyB3cm9uZywgcGxlYXNlIGFyZ3VlIHRoYXQgZXhwbGNpdGx5LiBPdGhlcndpc2UNCiAgICBw bGVhc2UgYmUgbmV1dHJhbCwgZS5nLjoNCiAgICANCiAgICBVTEFzIGNvdWxkIGJlIHVzZWQgZm9y IGluZnJhc3RydWN0dXJlIGhpZGluZyBhcyBkZXNjcmliZWQgaW4gW1JGQzQ4NjRdOy4uLg0KICAg IA0KICAgID4gSXQgaXMgcmVjb21tZW5kZWQgdG8gY29uc2lkZXIgZmlsdGVyaW5nIHBhY2tldHMg d2l0aCBVTEEgc291cmNlCQ0KICAgID4gYWRkcmVzc2VzIG9yIFVMQSBkZXN0aW5hdGlvbiBhZGRy ZXNzZXMgYXQgdGhlIGRvbWFpbiBib3VuZGFyeS4NCiAgICANCiAgICBBY3R1YWxseSBSRkM0MTkz IGlzIGFscmVhZHkgc3Ryb25nZXIgdGhhbiB0aGF0LiBGaWx0ZXJpbmcgVUxBIHJvdXRlcw0KICAg IGlzIGEgIm11c3QiLCBhbmQgZmlsdGVyaW5nIHBhY2tldHMgY29udGFpbmluZyBVTEEgc291cmNl IG9yIGRlc3RpbmF0aW9uDQogICAgaXMgYSAic2hvdWxkIiAodW5sZXNzIGV4cGxpY2l0bHkgY29u ZmlndXJlZCBvdGhlcndpc2UpLiBJIHRoaW5rIHlvdQ0KICAgIHNob3VsZCBub3Qgd2Vha2VuIHRo aXMgaGVyZSENCiAgICANCiAgICA+IDIuMS40LiAgVGVtcG9yYXJ5IEFkZHJlc3NlcyAtIFByaXZh Y3kgRXh0ZW5zaW9ucyBmb3IgU0xBQUMNCiAgICA+IA0KICAgID4gSGlzdG9yaWNhbGx5IHN0YXRl bGVzcyBhZGRyZXNzIGF1dG9jb25maWd1cmF0aW9uIChTTEFBQykgcmVsaWVzIG9uCQ0KICAgID4g dGhlIGF1dG9tYXRpY2FsbHkgZ2VuZXJhdGVkIEVVSS02NCBhZGRyZXNzLHdoaWNoIHRvZ2V0aGVy IHdpdGggdGhlCQ0KICAgID4gLzY0IHByZWZpeCBtYWtlcyB1cCB0aGUgZ2xvYmFsIHVuaXF1ZSBJ UHY2IGFkZHJlc3MuDQogICAgDQogICAgVGhhdCdzIGluYWNjdXJhdGUuIFRyeToNCiAgICANCiAg ICBIaXN0b3JpY2FsbHksIHN0YXRlbGVzcyBhZGRyZXNzIGF1dG9jb25maWd1cmF0aW9uIChTTEFB QykgcmVsaWVkIG9uCQ0KICAgIGFuIGF1dG9tYXRpY2FsbHkgZ2VuZXJhdGVkIDY0IGJpdCBpbnRl cmZhY2UgaWRlbnRpZmllciAoSUlEKSBiYXNlZA0KICAgIG9uIHRoZSBFVUktNjQgTUFDIGFkZHJl c3MsIHdoaWNoIHRvZ2V0aGVyIHdpdGggdGhlIC82NCBwcmVmaXggbWFrZXMNCiAgICB1cCB0aGUg Z2xvYmFsbHkgdW5pcXVlIElQdjYgYWRkcmVzcy4NCiAgICANCiAgICAuLi4uDQogICAgPiBBcyBb UkZDNDk0MV0gcHJpdmFjeSBleHRlbnNpb24gYWRkcmVzc2VzIGNvdWxkIGFsc28gYmUgdXNlZCB0 bw0KICAgID4gb2JmdXNjYXRlIHNvbWUgbWFsZXZvbGVudCBhY3Rpdml0aWVzICh3aGV0aGVyIG9u IHB1cnBvc2Ugb3Igbm90KSwNCiAgICA+IHNwZWNpZmljIHVzZXIgYXR0cmlidXRpb24vYWNjb3Vu dGFiaWxpdHkgcHJvY2VkdXJlcyBtdXN0IGJlIHB1dCBpbg0KICAgID4gcGxhY2UgYXMgZGVzY3Jp YmVkIGluIHNlY3Rpb24gU2VjdGlvbiAyLjYuDQogICAgDQogICAgVGhhdCAibXVzdCIgaXMgYSBi aXQgc3RyYW5nZS4gSXQgc2VlbXMgdG9vIG11Y2ggdG8gc2F5ICJNVVNUIiwNCiAgICBzbyB3aHkg bm90IG1ha2UgaXQgIlNIT1VMRCI/DQogICAgDQogICAgUmVnYXJkcw0KICAgICAgIEJyaWFuIENh cnBlbnRlcg0KICAgIA0KICAgIF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fDQogICAgT1BTRUMgbWFpbGluZyBsaXN0DQogICAgT1BTRUNAaWV0Zi5vcmcNCiAg ICBodHRwczovL3d3dy5pZXRmLm9yZy9tYWlsbWFuL2xpc3RpbmZvL29wc2VjDQogICAgDQoNCg== From nobody Mon Mar 11 07:35:48 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 220011277D8 for ; Mon, 11 Mar 2019 07:35:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id atRnKM18StaV for ; Mon, 11 Mar 2019 07:35:42 -0700 (PDT) Received: from mail-pg1-x52e.google.com (mail-pg1-x52e.google.com [IPv6:2607:f8b0:4864:20::52e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 65F2513109F for ; Mon, 11 Mar 2019 07:35:42 -0700 (PDT) Received: by mail-pg1-x52e.google.com with SMTP id e17so4194754pgd.2 for ; Mon, 11 Mar 2019 07:35:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=MmgmTD0AdDByBPNxKELJQymEnyI7K+fYowBEXa32gDA=; b=YIIAt3BBZ25YKyZOAcUhxI6qZutVN7Nn93ZaJu3X3MOrGzzs3nWCm+uUMb96qNzEp2 XhFqXNbCy7SDhI2bTf8JVfTXvMVg9nFk3gpsdWw1+wkezsaCm2tMjmXmkOTr9FN2jzKV WV2eQTFFbyX7W1ikYjsxfyDhD3maay/ObikXBoEiPp+xG0j5YKkusNjvSOQqvbp1I8Tj Q9MjeGt6WD3PzuJlpG8cjydPr/xkN2W4qikitkNUlT+shrH2aSE80UsLCO9QMa1b0bWW ssERkXM9DWwJt2gEKM7yDvNj1/frnaiBsIcH6QoYLeFcXWr2G/jOuM7qOnQoqbRAgfyB u93g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=MmgmTD0AdDByBPNxKELJQymEnyI7K+fYowBEXa32gDA=; b=DW93nc9+ubEVGSGhtTRWT4c/cBaihUDEnNPWPH3G0xzRUXYqpaWDuH0zkRnXGyevwm RNaBkdKz2+/u3gTWRlQo2s+wO3Q96vOoMslSB42myViE+oipUMXJzbNEbxIf19lM1f5E vUdgl+dFt/O4QUVbnTo+Zv2W2FxVWd1iGM8U76iCORZSHtexW9PUg5oxK/fPxrpOxTnK a36ypW23Dg5HFPXDTBin7Bplo+6sB7TPj1T+hrHF9ZrIZno0Z+KEo+nWqWd6PRhp9iMV QznbC1NLY5yjw0lfUBpXGJeQFFZh9m1BWM131iZqLkl4hnkvaauaCDJ6jIO6XXdLZeLh poaQ== X-Gm-Message-State: APjAAAUJJzFozYUsPueV73TGtcYVWym3qAoI4NQyK4ghOkl+UMTbF16K CdhGgFmvNUmheFAGcCc8dDk= X-Google-Smtp-Source: APXvYqwldINQdcSwSEgNAbq6uraDFy9rx8in7G15Xld8sQI/YGWZJOI83Ib7okNB3JkHgWxH43ddoA== X-Received: by 2002:a62:11ca:: with SMTP id 71mr33109417pfr.18.1552314941915; Mon, 11 Mar 2019 07:35:41 -0700 (PDT) Received: from ?IPv6:2601:647:4d01:f3a:c818:22fb:ae90:70ec? ([2601:647:4d01:f3a:c818:22fb:ae90:70ec]) by smtp.gmail.com with ESMTPSA id x15sm8142153pfn.74.2019.03.11.07.35.40 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 11 Mar 2019 07:35:41 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) From: Bob Hinden In-Reply-To: Date: Mon, 11 Mar 2019 07:35:40 -0700 Cc: Bob Hinden , Brian Carpenter , "opsec@ietf.org" Content-Transfer-Encoding: quoted-printable Message-Id: References: <155216353255.28690.611573903036715612@ietfa.amsl.com> To: "Eric Vyncke (evyncke)" X-Mailer: Apple Mail (2.3445.102.3) Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-15.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 14:35:47 -0000 Eric, I hope to do last read through today or tomorrow. I was only = commenting on Brian=E2=80=99s email. I will look for the -16 when it is = out. Thanks, Bob > On Mar 11, 2019, at 1:44 AM, Eric Vyncke (evyncke) = wrote: >=20 > Brian and Bob, >=20 > First of all, thank you for the quick review. And especially, the text = around EUI-64 & SLAAC which we, the authors, will gladly accept. >=20 > In order to progress with this draft, the authors will issue today a = -16 where the ULA section will simply be reduced to mention the ULA = considerations draft. With this, we hope to remove the last (?) blocking = factor for this OPsecv6 draft. >=20 > Regards >=20 > -=C3=A9ric >=20 > =EF=BB=BFOn 09/03/2019, 22:56, "OPSEC on behalf of Brian E Carpenter" = wrote: >=20 > Hi, >=20 > A few comments. (Note that I am not on the opsec list, so please CC = me on any replies.) >=20 >> 2.1.2. Use of ULAs > .... >> It is tempting to think that ULAs could be useful for infrastructure >> hiding as described in [RFC4864];... >=20 > That's a very strange choice of words, and ignores the actual = argument > for this choice, which is that internal communications using ULAs > are doubly protected from accidental external visibility. If you = want > to say that RFC4864 was wrong, please argue that explcitly. = Otherwise > please be neutral, e.g.: >=20 > ULAs could be used for infrastructure hiding as described in = [RFC4864];... >=20 >> It is recommended to consider filtering packets with ULA source=09 >> addresses or ULA destination addresses at the domain boundary. >=20 > Actually RFC4193 is already stronger than that. Filtering ULA = routes > is a "must", and filtering packets containing ULA source or = destination > is a "should" (unless explicitly configured otherwise). I think you > should not weaken this here! >=20 >> 2.1.4. Temporary Addresses - Privacy Extensions for SLAAC >>=20 >> Historically stateless address autoconfiguration (SLAAC) relies on=09 >> the automatically generated EUI-64 address,which together with the=09 >> /64 prefix makes up the global unique IPv6 address. >=20 > That's inaccurate. Try: >=20 > Historically, stateless address autoconfiguration (SLAAC) relied on=09= > an automatically generated 64 bit interface identifier (IID) based > on the EUI-64 MAC address, which together with the /64 prefix makes > up the globally unique IPv6 address. >=20 > .... >> As [RFC4941] privacy extension addresses could also be used to >> obfuscate some malevolent activities (whether on purpose or not), >> specific user attribution/accountability procedures must be put in >> place as described in section Section 2.6. >=20 > That "must" is a bit strange. It seems too much to say "MUST", > so why not make it "SHOULD"? >=20 > Regards > Brian Carpenter >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec >=20 >=20 > _______________________________________________ > OPSEC mailing list > OPSEC@ietf.org > https://www.ietf.org/mailman/listinfo/opsec From nobody Mon Mar 11 14:24:09 2019 Return-Path: X-Original-To: opsec@ietf.org Delivered-To: opsec@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id EE6C71311D6; Mon, 11 Mar 2019 14:23:58 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: internet-drafts@ietf.org To: Cc: opsec@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 6.93.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: opsec@ietf.org Message-ID: <155233943892.23130.2262598695423467301@ietfa.amsl.com> Date: Mon, 11 Mar 2019 14:23:58 -0700 Archived-At: Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-16.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 21:24:03 -0000 A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Operational Security Capabilities for IP Network Infrastructure WG of the IETF. Title : Operational Security Considerations for IPv6 Networks Authors : Eric Vyncke Kiran K. Chittimaneni Merike Kaeo Enno Rey Filename : draft-ietf-opsec-v6-16.txt Pages : 50 Date : 2019-03-11 Abstract: Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in several places of a network (enterprises, service providers and residential users) and proposes technical and procedural mitigations techniques. Some very specific place of a network such as Internet of Things are not discussed in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsec-v6-16 https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-16 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=draft-ietf-opsec-v6-16 Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ From nobody Mon Mar 11 15:26:02 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 805F51310C6; Mon, 11 Mar 2019 15:25:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NP6N1MslKF1f; Mon, 11 Mar 2019 15:25:44 -0700 (PDT) Received: from lxdnp29m.centurylink.com (lxdnp29m.centurylink.com [155.70.32.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 695C81311A3; Mon, 11 Mar 2019 15:25:44 -0700 (PDT) Received: from lxdnp04n.corp.intranet (emailout.qintra.com [151.119.92.83]) by lxdnp29m.centurylink.com (8.14.8/8.14.8) with ESMTP id x2BMPhrB063039 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=FAIL); Mon, 11 Mar 2019 16:25:43 -0600 Received: from lxdnp04n.corp.intranet (localhost [127.0.0.1]) by lxdnp04n.corp.intranet (8.14.8/8.14.8) with ESMTP id x2BMPcXO022482; Mon, 11 Mar 2019 16:25:38 -0600 Received: from lxomp06u.corp.intranet (lxdnp23m.corp.intranet [151.119.92.134]) by lxdnp04n.corp.intranet (8.14.8/8.14.8) with ESMTP id x2BMPcGH022474 (version=TLSv1/SSLv3 cipher=AES256-SHA256 bits=256 verify=NO); Mon, 11 Mar 2019 16:25:38 -0600 Received: from lxomp06u.corp.intranet (localhost [127.0.0.1]) by lxomp06u.corp.intranet (8.14.8/8.14.8) with ESMTP id x2BMPcgn047716; Mon, 11 Mar 2019 17:25:38 -0500 Received: from vddcwhubex502.ctl.intranet (vddcwhubex502.ctl.intranet [151.119.128.29]) by lxomp06u.corp.intranet (8.14.8/8.14.8) with ESMTP id x2BMPcTe047713 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Mon, 11 Mar 2019 17:25:38 -0500 Received: from PDDCWMBXEX503.ctl.intranet ([fe80::9033:ef22:df02:32a9]) by vddcwhubex502.ctl.intranet ([151.119.128.29]) with mapi id 14.03.0415.000; Mon, 11 Mar 2019 16:25:37 -0600 From: "Smith, Donald" To: "opsec@ietf.org" , "i-d-announce@ietf.org" Thread-Topic: [OPSEC] I-D Action: draft-ietf-opsec-v6-16.txt Thread-Index: AQHU2FD6A5iGsgDWfEqmQ60G22MAPKYHAbr2 Date: Mon, 11 Mar 2019 22:25:36 +0000 Message-ID: <68EFACB32CF4464298EA2779B058889D53E8B04C@PDDCWMBXEX503.ctl.intranet> References: <155233943892.23130.2262598695423467301@ietfa.amsl.com> In-Reply-To: <155233943892.23130.2262598695423467301@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [151.119.128.8] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-TM-AS-MML: disable X-CFilter-Loop: Reflected Archived-At: Subject: Re: [OPSEC] I-D Action: draft-ietf-opsec-v6-16.txt X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 11 Mar 2019 22:25:47 -0000 I see GTSM lightly mentioned here: "4.1. BGP The threats and mitigation techniques are identical between IPv4 and IPv6. Broadly speaking they are: o Authenticating the TCP session; o TTL security (which becomes hop-limit security in IPv6); o Prefix Filtering. These are explained in more detail in section Section 2.5." But 2.5 doesn't talk to hop limit or GTSM at all. if (initial_ttl!=3D255) then (rfc5082_compliant=3D=3D0) Donald.Smith@centurylink.com ________________________________________ From: OPSEC [opsec-bounces@ietf.org] on behalf of internet-drafts@ietf.org = [internet-drafts@ietf.org] Sent: Monday, March 11, 2019 3:23 PM To: i-d-announce@ietf.org Cc: opsec@ietf.org Subject: [OPSEC] I-D Action: draft-ietf-opsec-v6-16.txt A New Internet-Draft is available from the on-line Internet-Drafts director= ies. This draft is a work item of the Operational Security Capabilities for IP N= etwork Infrastructure WG of the IETF. Title : Operational Security Considerations for IPv6 Netw= orks Authors : Eric Vyncke Kiran K. Chittimaneni Merike Kaeo Enno Rey Filename : draft-ietf-opsec-v6-16.txt Pages : 50 Date : 2019-03-11 Abstract: Knowledge and experience on how to operate IPv4 securely is available: whether it is the Internet or an enterprise internal network. However, IPv6 presents some new security challenges. RFC 4942 describes the security issues in the protocol but network managers also need a more practical, operations-minded document to enumerate advantages and/or disadvantages of certain choices. This document analyzes the operational security issues in several places of a network (enterprises, service providers and residential users) and proposes technical and procedural mitigations techniques. Some very specific place of a network such as Internet of Things are not discussed in this document. The IETF datatracker status page for this draft is: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6/ There are also htmlized versions available at: https://tools.ietf.org/html/draft-ietf-opsec-v6-16 https://datatracker.ietf.org/doc/html/draft-ietf-opsec-v6-16 A diff from the previous version is available at: https://www.ietf.org/rfcdiff?url2=3Ddraft-ietf-opsec-v6-16 Please note that it may take a couple of minutes from the time of submissio= n until the htmlized version and diff are available at tools.ietf.org. Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ _______________________________________________ OPSEC mailing list OPSEC@ietf.org https://www.ietf.org/mailman/listinfo/opsec This communication is the property of CenturyLink and may contain confident= ial or privileged information. Unauthorized use of this communication is st= rictly prohibited and may be unlawful. If you have received this communicat= ion in error, please immediately notify the sender by reply e-mail and dest= roy all copies of the communication and any attachments. From nobody Sat Mar 30 03:33:24 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 709721200FB for ; Sat, 30 Mar 2019 03:33:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.998 X-Spam-Level: X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wgCoUE-pFumB for ; Sat, 30 Mar 2019 03:33:19 -0700 (PDT) Received: from mail-wm1-x32c.google.com (mail-wm1-x32c.google.com [IPv6:2a00:1450:4864:20::32c]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CCD3C120026 for ; Sat, 30 Mar 2019 03:33:18 -0700 (PDT) Received: by mail-wm1-x32c.google.com with SMTP id v14so5596873wmf.2 for ; Sat, 30 Mar 2019 03:33:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:date:references:cc:to:message-id; bh=rGK2yfXy1CZ0k6UHkZ0kzNVwOQUbFG2DR4kBtyr+FVI=; b=iIn4UjH52SXfD6ybZ32awUPhoLfg9ACJx4dav2uMPMv1HwQWw7rFJCif4xbyTgG5Ef Mc7pW+GCXcjLNGjbUqsJE0jMpxv3sbdzjawHWpGuh0AA+FKvkn820ETTaaFPJc9i/weG m6+f5uiZABo652wixuwhdV/QmXecaV1bPSi3C/W+TyasctXNRUFwqc/WEb/i/qFaNwDP ZD7/9ofFj+OQoRAN/xCl/12KRpRizRl9AT1gyFbNPIbpzLdy7UTbORScBgRDhRiPEH+b XOHuutNE2V1/xre4zZ4+icHN6tqNA6dgBZYWQlbw1WuvJD3q/xQZhxr+akqcC1Q/J4Ka EcQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:date:references:cc:to :message-id; bh=rGK2yfXy1CZ0k6UHkZ0kzNVwOQUbFG2DR4kBtyr+FVI=; b=ImMuwAxJ/yPykFOlNn/mgr8taD6GCUmkHpfh0ztCZfzC0hAIVKKKhC4PRm8nQQQHq6 MUuERrzI7DNH+j8uZ2okB+o44LA2do5ezboWc/ZT5TOTqclzyAGZqEvFLS03iQKg2lxC XiqMXgmtLXazb2ky5rLC9XzQ9hFwboHK4bNE6MplJvXGu+F27vpaZmBEmFm1sfFG6GK1 9y5k3t7x3Plp0RXa8NtyrsjfssfjPM6e+y0nIHLw+GQ3hwVMZMWmGI4DK2mHrxIgGRL3 kOvjuTwe01LhrvwSWrBtWThV0Ubmn9mWkUf3O1MJ2FSKIYJcmF+U8i8mUydhgGQkaXId e/kw== X-Gm-Message-State: APjAAAUna+yxlkhaBLzjWVEAopao4KlgtLkVh3B0pOQi9pnbUa9pSCyl 4qzQb46jaetR9LA3LLzz2r41hEKxySY= X-Google-Smtp-Source: APXvYqzcSCZvXlwP2y/x/R1PqIjB9byj4YB3t5N3LA+3bvf3xfAQDx62zLmXxn6xsvg2m8JRVGds6g== X-Received: by 2002:a1c:4187:: with SMTP id o129mr6072608wma.57.1553941996990; Sat, 30 Mar 2019 03:33:16 -0700 (PDT) Received: from [10.0.6.52] ([80.188.36.206]) by smtp.gmail.com with ESMTPSA id y8sm4685315wrm.8.2019.03.30.03.33.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 30 Mar 2019 03:33:15 -0700 (PDT) From: Fred Baker Content-Type: multipart/signed; boundary="Apple-Mail=_C72B5315-7AC7-45FC-B670-417018D2613E"; protocol="application/pgp-signature"; micalg=pgp-sha512 Mime-Version: 1.0 (Mac OS X Mail 12.4 \(3445.104.8\)) Date: Sat, 30 Mar 2019 11:33:13 +0100 References: <74D0026C-9DB6-43E1-8674-6AEF84D4DFF8@consulintel.es> To: opsec@ietf.org Message-Id: <3A7EB7FA-EBA4-4BD8-9E62-116641C66AE6@gmail.com> X-Mailer: Apple Mail (2.3445.104.8) Archived-At: Subject: [OPSEC] Fwd: [v6ops] draft-ietf-opsec-v6 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Mar 2019 10:33:23 -0000 --Apple-Mail=_C72B5315-7AC7-45FC-B670-417018D2613E Content-Type: multipart/alternative; boundary="Apple-Mail=_1749D35A-1BFB-48CB-8F0D-5D31B6026A6D" --Apple-Mail=_1749D35A-1BFB-48CB-8F0D-5D31B6026A6D Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 This was sent to v6ops instead of opsec > From: JORDI PALET MARTINEZ = > Subject: Re: [v6ops] draft-ietf-opsec-v6 > Date: March 29, 2019 at 5:13:32 PM GMT+1 > To: IPv6 Operations >=20 > Hi all, >=20 > Thanks for the reminder, overdue task for me for a while ... So here = is it (partially, as I'm working in the plane, so more in following = emails). >=20 > 2.1. Addressing Architecture >=20 > Once an address allocation has been assigned, there should be some > thought given to an overall address allocation plan. With the > abundance of address space available, an address allocation may be > structured around services along with geographic locations, which > then can be a basis for more structured security policies to permit > or deny services between geographic regions. >=20 > One of MOST frequent issues when you start implementing IPv6 is that = people tend to go to their RIR for a default allocation/assignment, and = then try to make the addressing plan with what they have, instead of = planning correctly and then going to the RIR. The result is many cases = is ISPs providing a single /64 to customers, which is really bad. >=20 > Also, if the document is for operators and enterprises, you need to = differentiate among allocation and assignment. >=20 > So, I will like to suggest rewording as: > "A key task before starting an IPv6 deployment, once the sufficient = knowledge has been acquired, is to prepare an addressing plan. With the = abundance of address space available, an addressing plan may be = structured around services along with geographic locations, which then = can be a basis for more structured security policies to permit or deny = services between geographic regions. >=20 > This may be seen as a simple task, but it is an activity within the = IPv6 deployment project, that requires a very in depth thinking and it = makes sense to invest as much time as required on it. Only once that = addressing plan has been designed is the right time to go to the = relevant Regional Internet Registry (RIR) to ask for an allocation or an = assignment." >=20 > Then, in the next p.: >=20 > A common question is whether companies should use Provider > Independent (PI) vs Provider Allocated (PA) space [RFC7381], but = from > a security perspective there is little difference. >=20 > Replace with >=20 > "A common question is whether companies should use Provider = Independent (PI) vs Provider Allocated (PA) space [RFC7381], but from a = security perspective there is little difference. =46rom the RIRs = policies perspective, PI space is assigned to organizations if they = don't need to sub-assign to third parties, while PA is allocated to = operators or organizations that will sub-assign to third parties. For = example, a big corporation may have different subsidiaries and they are = legally different entities, so in this case each one need their own PI = space, or the responsible for the network need to get allocated PA = space. A public institution such as a Ministry, may get a PI, if is only = for their own use and not for other government institutions, however if = it is the government entity managing the network that interconnects = several institutions and provide each one their own space, they need to = obtain PA space." >=20 > And continue with "However, one ..." in a new p. >=20 > 2.1.1. Statically Configured Addresses >=20 > Nit: > The use of well-known(such > The use of well-known (such >=20 > There are many scanning techniques and more to > come possible, hence, operators should never relly on the = 'impossible > to find because my address is random' paradigm. >=20 > I will say: >=20 > There are many scanning techniques and more to > come possible, hence, operators should never relly on the = 'impossible > to find because my address is random' paradigm, even if it is a good = practice to have the statically configured addresses randomly = distributed across the /64 subnets and use always DNS. >=20 > 2.1.2. Use of ULAs >=20 > I will add: >=20 > "Even if today a network is not connected to Internet, and it looks = like it will not be in the future, things change and it is a = considerable effort to renumber it. So it may be relevant to obtain an = IPv6 PI assignment from the RIR and have a stable addressing space since = day one." >=20 > 2.1.3. Point-to-Point Links >=20 > I disagree with the mention that RFC6164 indicate that /127 is the = way. RFC6164 is about "routers must support it". See = draft-palet-v6ops-p2p-links (new version coming soon, so may be a = reference to it). So I think some rewording is needed here, specially = because router vendors sorted out those bugs long time ago. >=20 > 2.1.4. Temporary Addresses - Privacy Extensions for SLAAC >=20 > I will add, that "In those cases where accounting/auditing/extreme = granular security is required, because is impractical to use DHCPv6 due = to the lack of support in Android based OSs, link-layer security such as = IEEE802.1x may be used." >=20 > 2.1.6. DHCP/DNS Considerations >=20 > This probably belongs to another section (may be a specific one for = DNS), but related: >=20 > "If there is a need for Statically Configured Addresses, it should = considered using DNS to refer to them, so no hard-coded addresses are = used by applications. This facilitates also debugging/troubleshooting as = avoids remembering addresses. In may be advisable to have multiple-faced = DNS ("views") in order to ensure that internal-only used hosts, aren't = published globally and full zone transfers are disallowed." >=20 > 2.1.7. Using a /64 per host >=20 > I will add: >=20 > "This also avoids the need to "proxy" or NAT-like operations if = multiple VMs, containers, or similar ones, need their own IPv6 address = from a single /64 ." >=20 > Regards, > Jordi >=20 >=20 >=20 > =EF=BB=BFEl 29/3/19 6:19, "v6ops en nombre de Fred Baker" = = escribi=C3=B3: >=20 > Yesterday, the authors of an opec draft asked us for comments on = their draft, which is in a second WGLC in opec (opsec@ietf.org). You may = have missed the character string: >=20 > https://datatracker.ietf.org/doc/draft-ietf-opsec-v6 > https://tools.ietf.org/html/draft-ietf-opsec-v6 > "Operational Security Considerations for IPv6 Networks", Eric = Vyncke, > Chittimaneni Kk, Merike Kaeo, Enno Rey, 2019-03-11, >=20 > I'd encourage people to read it and comment on the opec list. >=20 > = --------------------------------------------------------------------------= ------ > Victorious warriors win first and then go to war, > Defeated warriors go to war first and then seek to win. > Sun Tzu >=20 > _______________________________________________ > v6ops mailing list > v6ops@ietf.org > https://www.ietf.org/mailman/listinfo/v6ops >=20 >=20 >=20 >=20 > ********************************************** > IPv4 is over > Are you ready for the new Internet ? > http://www.theipv6company.com > The IPv6 Company >=20 > This electronic message contains information which may be privileged = or confidential. The information is intended to be for the exclusive use = of the individual(s) named above and further non-explicilty authorized = disclosure, copying, distribution or use of the contents of this = information, even if partially, including attached files, is strictly = prohibited and will be considered a criminal offense. If you are not the = intended recipient be aware that any disclosure, copying, distribution = or use of the contents of this information, even if partially, including = attached files, is strictly prohibited, will be considered a criminal = offense, so you must reply to the original sender to inform about this = communication and delete it. >=20 >=20 >=20 > _______________________________________________ > v6ops mailing list > v6ops@ietf.org > https://www.ietf.org/mailman/listinfo/v6ops = --------------------------------------------------------------------------= ------ The fact that there is a highway to hell and a stairway to heaven is an = interesting comment on projected traffic volume... --Apple-Mail=_1749D35A-1BFB-48CB-8F0D-5D31B6026A6D Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 This = was sent to v6ops instead of opsec

From: JORDI PALET MARTINEZ <jordi.palet=3D40consulintel.es@dmarc.ietf.org>
Subject: = Re: [v6ops] = draft-ietf-opsec-v6
Date: = March 29, 2019 at 5:13:32 PM = GMT+1
To: = IPv6 Operations <v6ops@ietf.org>

Hi = all,

Thanks for the reminder, overdue task = for me for a while ... So here is it (partially, as I'm working in the = plane, so more in following emails).

2.1. =  Addressing Architecture

=   Once an address allocation has been assigned, there should = be some
  thought given to an overall address = allocation plan.  With the
  abundance of = address space available, an address allocation may be
=   structured around services along with geographic locations, = which
  then can be a basis for more structured = security policies to permit
  or deny services = between geographic regions.

One of MOST = frequent issues when you start implementing IPv6 is that people tend to = go to their RIR for a default allocation/assignment, and then try to = make the addressing plan with what they have, instead of planning = correctly and then going to the RIR. The result is many cases is ISPs = providing a single /64 to customers, which is really bad.

Also, if the document is for operators and = enterprises, you need to differentiate among allocation and = assignment.

So, I will like to suggest = rewording as:
"A key task before starting an IPv6 = deployment, once the sufficient knowledge has been acquired, is to = prepare an addressing plan. With the abundance of address space = available, an addressing plan may be structured around services along = with geographic locations, which then can be a basis for more structured = security policies to permit or deny services between geographic = regions.

This may be seen as a simple task, = but it is an activity within the IPv6 deployment project, that requires = a very in depth thinking and it makes sense to invest as much time as = required on it. Only once that addressing plan has been designed is the = right time to go to the relevant Regional Internet Registry (RIR) to ask = for an allocation or an assignment."

Then, = in the next p.:

  A common = question is whether companies should use Provider
=   Independent (PI) vs Provider Allocated (PA) space [RFC7381], = but from
  a security perspective there is = little difference.

Replace with

"A common question is whether companies should = use Provider Independent (PI) vs Provider Allocated (PA) space = [RFC7381], but from a security perspective there is little difference. = =46rom the RIRs policies perspective, PI space is assigned to = organizations if they don't need to sub-assign to third parties, while = PA is allocated to operators or organizations that will sub-assign to = third parties. For example, a big corporation may have different = subsidiaries and they are legally different entities, so in this case = each one need their own PI space, or the responsible for the network = need to get allocated PA space. A public institution such as a Ministry, = may get a PI, if is only for their own use and not for other government = institutions, however if it is the government entity managing the = network that interconnects several institutions and provide each one = their own space, they need to obtain PA space."

And continue with "However, one ..." in a new p.

2.1.1.  Statically Configured = Addresses

Nit:
The use of = well-known(such
The use of well-known (such

There are many scanning techniques and more = to
  come possible, hence, operators should = never relly on the 'impossible
  to find = because my address is random' paradigm.

I = will say:

There are many scanning = techniques and more to
  come possible, hence, = operators should never relly on the 'impossible
=   to find because my address is random' paradigm, even if it = is a good practice to have the statically configured addresses randomly = distributed across the /64 subnets and use always DNS.

2.1.2.  Use of ULAs

I will = add:

"Even if today a network is not = connected to Internet, and it looks like it will not be in the future, = things change and it is a considerable effort to renumber it. So it may = be relevant to obtain an IPv6 PI assignment from the RIR and have a = stable addressing space since day one."

2.1.3.  Point-to-Point Links

I disagree with the mention that RFC6164 indicate that /127 = is the way. RFC6164 is about "routers must support it". See = draft-palet-v6ops-p2p-links (new version coming soon, so may be a = reference to it). So I think some rewording is needed here, specially = because router vendors sorted out those bugs long time ago.

2.1.4.  Temporary Addresses - Privacy = Extensions for SLAAC

I will add, that "In = those cases where accounting/auditing/extreme granular security is = required, because is impractical to use DHCPv6 due to the lack of = support in Android based OSs, link-layer security such as IEEE802.1x may = be used."

2.1.6.  DHCP/DNS = Considerations

This probably belongs to = another section (may be a specific one for DNS), but related:

"If there is a need for Statically Configured = Addresses, it should considered using DNS to refer to them, so no = hard-coded addresses are used by applications. This facilitates also = debugging/troubleshooting as avoids remembering addresses. In may be = advisable to have multiple-faced DNS ("views") in order to ensure that = internal-only used hosts, aren't published globally and full zone = transfers are disallowed."

2.1.7. =  Using a /64 per host

I will add:

"This also avoids the need to "proxy" or = NAT-like operations if multiple VMs, containers, or similar ones, need = their own IPv6 address from a single /64 ."

Regards,
Jordi



=EF=BB=BFEl 29/3/19 6:19, "v6ops en nombre de = Fred Baker" <v6ops-bounces@ietf.org en nombre de fredbaker.ietf@gmail.com> escribi=C3=B3:

   Yesterday, the authors of = an opec draft asked us for comments on their draft, which is in a second = WGLC in opec (opsec@ietf.org). You may have missed the character = string:

   https://datatracker.ietf.org/doc/draft-ietf-opsec-v6
   https://tools.ietf.org/html/draft-ietf-opsec-v6
     "Operational Security = Considerations for IPv6 Networks", Eric Vyncke,
=      Chittimaneni Kk, Merike Kaeo, Enno Rey, = 2019-03-11,

   I'd = encourage people to read it and comment on the opec list.

=    --------------------------------------------------------= ------------------------
   Victorious = warriors win first and then go to war,
=    Defeated warriors go to war first and then seek to = win.
        Sun = Tzu

=    _______________________________________________
   v6ops mailing list
=    v6ops@ietf.org
   https://www.ietf.org/mailman/listinfo/v6ops




**********************************************
IPv4 is over
Are you ready for the new Internet = ?
http://www.theipv6company.com
The IPv6 = Company

This electronic message contains = information which may be privileged or confidential. The information is = intended to be for the exclusive use of the individual(s) named above = and further non-explicilty authorized disclosure, copying, distribution = or use of the contents of this information, even if partially, including = attached files, is strictly prohibited and will be considered a criminal = offense. If you are not the intended recipient be aware that any = disclosure, copying, distribution or use of the contents of this = information, even if partially, including attached files, is strictly = prohibited, will be considered a criminal offense, so you must reply to = the original sender to inform about this communication and delete it.



_______________________________________________
v6ops mailing list
v6ops@ietf.org
https://www.ietf.org/mailman/listinfo/v6ops

---------------------------------------------------------------= -----------------
The fact that = there is a highway to hell and a stairway to heaven is an interesting = comment on projected traffic volume...

= --Apple-Mail=_1749D35A-1BFB-48CB-8F0D-5D31B6026A6D-- --Apple-Mail=_C72B5315-7AC7-45FC-B670-417018D2613E Content-Transfer-Encoding: 7bit Content-Disposition: attachment; filename=signature.asc Content-Type: application/pgp-signature; name=signature.asc Content-Description: Message signed with OpenPGP -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEctjlJjQmVrp9uMq7EhdRnd2GP+AFAlyfReoACgkQEhdRnd2G P+BXyg//UwyDqiudwTr7sqIOBR14xOxTBGS9ZrStJjQ7HHHG0UCrH+7bUriPNw27 97hIa7h6Ya0jLbt5s7e2qAUpvbDCgsz1A/Y4b7MhXdVoTpm0tl9S2Q/PSeRQFl+u ZKYWF3Y/0BYjUjIbbAwvLCzDxuq6rsDA6yNCyhjnCISl/cHGM+t18r1JQp7WsFiU bl9OM9SV1DdFksY0iwtp8iBAWv1flhOywYq5XezUiTFskBMcCOcVC7erg/nEW3C9 maqvAgsxB1Vuz304FblU1tTU1Yn7AqEFt76BYMWqwbbTqIoJriG9G+nbjLws1eOZ JiPBA9LQqNE17u7jY1e5nWA76mkxOGvNXfUkoe0wgphdp+Er0KgKJhfDX1W7jmlI kD48GfrDiEuFN0QTeLRyZfUGLYsqAnKnh/zVx+pqUyvMZP6hJay8e7eM3n1/25fN 8jxRQ+epgx/tCKnNJAB5di+wPPMvzN1SY9jJPp8GUjhwHiIeoUv9RvmgJbUN4Vzo MMWsnZefZou/wQdqPDzSOv23I5dPlR9/fkt4doKtPaTMNG1LF+66sidGhZiuacoM 1kmLV7lhAcqtCFbJG0rYo4V7piMdNF/3OWNWKiuaHTdcD++hTCZuMNDGe/d1gouw q8KhpCwMCyHVOqIPNQ4a6z7porP6S6AI59TvFL0fTVye1Gd8AI0= =j1e9 -----END PGP SIGNATURE----- --Apple-Mail=_C72B5315-7AC7-45FC-B670-417018D2613E-- From nobody Sat Mar 30 03:43:12 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B9ED81201C6 for ; Sat, 30 Mar 2019 03:43:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.997 X-Spam-Level: X-Spam-Status: No, score=-1.997 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=0.001, MIME_QP_LONG_LINE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=consulintel.es Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id djSE0wRVEdP1 for ; Sat, 30 Mar 2019 03:43:02 -0700 (PDT) Received: from mail.consulintel.es (mail.consulintel.es [IPv6:2001:470:1f09:495::5]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E3F2E120026 for ; Sat, 30 Mar 2019 03:43:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=consulintel.es; s=MDaemon; t=1553942580; x=1554547380; i=jordi.palet@consulintel.es; q=dns/txt; h=User-Agent:Date: Subject:From:To:Message-ID:Thread-Topic:References:In-Reply-To: Mime-version:Content-type; bh=wN4sp9k5c6ZVHC2Id9LcI5pwd7biGCAte0 mMuLLDlsw=; b=Fd5I0lUaVYmTtLYOyMxIl6JSxqt6PKFkjCI4tgERBxwrT3AKBj BlPIAf3IAYWP+tRLmR/ItbItSS4Wq1bWIzkoEkP8OmXseG0kFjjnPJVSUMGh9x4j pThDsJus7q/xKg6Sl2G8CU5qc5c5dizgXA7H4eCeTaAcsPcvblArqUROg= X-MDAV-Result: clean X-MDAV-Processed: mail.consulintel.es, Sat, 30 Mar 2019 11:43:00 +0100 X-Spam-Processed: mail.consulintel.es, Sat, 30 Mar 2019 11:42:58 +0100 Received: from [10.10.10.139] by mail.consulintel.es (MDaemon PRO v16.5.2) with ESMTPA id md50006203378.msg for ; Sat, 30 Mar 2019 11:42:58 +0100 X-MDRemoteIP: 2001:470:1f09:495:89b:85cd:3d1f:ae66 X-MDHelo: [10.10.10.139] X-MDArrival-Date: Sat, 30 Mar 2019 11:42:58 +0100 X-Authenticated-Sender: jordi.palet@consulintel.es X-Return-Path: prvs=19925d7c34=jordi.palet@consulintel.es X-Envelope-From: jordi.palet@consulintel.es X-MDaemon-Deliver-To: opsec@ietf.org User-Agent: Microsoft-MacOutlook/10.10.8.190312 Date: Sat, 30 Mar 2019 11:42:53 +0100 From: JORDI PALET MARTINEZ To: Message-ID: <7B027755-3D55-4417-97B5-147DC9348E81@consulintel.es> Thread-Topic: [v6ops] draft-ietf-opsec-v6 References: <74D0026C-9DB6-43E1-8674-6AEF84D4DFF8@consulintel.es> <3A7EB7FA-EBA4-4BD8-9E62-116641C66AE6@gmail.com> In-Reply-To: <3A7EB7FA-EBA4-4BD8-9E62-116641C66AE6@gmail.com> Mime-version: 1.0 Content-type: multipart/alternative; boundary="B_3636790973_1769206433" Archived-At: Subject: Re: [OPSEC] [v6ops] draft-ietf-opsec-v6 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Mar 2019 10:43:10 -0000 > This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. --B_3636790973_1769206433 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Sorry about that, just clicked reply! =20 I=E2=80=99m working already, hopefully finish today, to review the other 40= pages. It is a really long document! May be I will break it down in severa= l parts. =20 I will make sure to submit to opsec this time! Regards, Jordi =20 =20 =20 El 30/3/19 11:33, "Fred Baker" escribi=C3=B3: =20 This was sent to v6ops instead of opsec From: JORDI PALET MARTINEZ Subject: Re: [v6ops] draft-ietf-opsec-v6 Date: March 29, 2019 at 5:13:32 PM GMT+1 To: IPv6 Operations =20 Hi all, Thanks for the reminder, overdue task for me for a while ... So here is it = (partially, as I'm working in the plane, so more in following emails). 2.1. Addressing Architecture Once an address allocation has been assigned, there should be some thought given to an overall address allocation plan. With the abundance of address space available, an address allocation may be structured around services along with geographic locations, which then can be a basis for more structured security policies to permit or deny services between geographic regions. One of MOST frequent issues when you start implementing IPv6 is that people= tend to go to their RIR for a default allocation/assignment, and then try = to make the addressing plan with what they have, instead of planning correc= tly and then going to the RIR. The result is many cases is ISPs providing a= single /64 to customers, which is really bad. Also, if the document is for operators and enterprises, you need to differe= ntiate among allocation and assignment. So, I will like to suggest rewording as: "A key task before starting an IPv6 deployment, once the sufficient knowled= ge has been acquired, is to prepare an addressing plan. With the abundance = of address space available, an addressing plan may be structured around ser= vices along with geographic locations, which then can be a basis for more s= tructured security policies to permit or deny services between geographic r= egions. This may be seen as a simple task, but it is an activity within the IPv6 de= ployment project, that requires a very in depth thinking and it makes sense= to invest as much time as required on it. Only once that addressing plan h= as been designed is the right time to go to the relevant Regional Internet = Registry (RIR) to ask for an allocation or an assignment." Then, in the next p.: A common question is whether companies should use Provider Independent (PI) vs Provider Allocated (PA) space [RFC7381], but from a security perspective there is little difference. Replace with "A common question is whether companies should use Provider Independent (PI= ) vs Provider Allocated (PA) space [RFC7381], but from a security perspecti= ve there is little difference. From the RIRs policies perspective, PI space= is assigned to organizations if they don't need to sub-assign to third par= ties, while PA is allocated to operators or organizations that will sub-ass= ign to third parties. For example, a big corporation may have different sub= sidiaries and they are legally different entities, so in this case each one= need their own PI space, or the responsible for the network need to get al= located PA space. A public institution such as a Ministry, may get a PI, if= is only for their own use and not for other government institutions, howev= er if it is the government entity managing the network that interconnects s= everal institutions and provide each one their own space, they need to obta= in PA space." And continue with "However, one ..." in a new p. 2.1.1. Statically Configured Addresses Nit: The use of well-known(such The use of well-known (such There are many scanning techniques and more to come possible, hence, operators should never relly on the 'impossible to find because my address is random' paradigm. I will say: There are many scanning techniques and more to come possible, hence, operators should never relly on the 'impossible to find because my address is random' paradigm, even if it is a good prac= tice to have the statically configured addresses randomly distributed acros= s the /64 subnets and use always DNS. 2.1.2. Use of ULAs I will add: "Even if today a network is not connected to Internet, and it looks like it= will not be in the future, things change and it is a considerable effort t= o renumber it. So it may be relevant to obtain an IPv6 PI assignment from t= he RIR and have a stable addressing space since day one." 2.1.3. Point-to-Point Links I disagree with the mention that RFC6164 indicate that /127 is the way. RFC= 6164 is about "routers must support it". See draft-palet-v6ops-p2p-links (n= ew version coming soon, so may be a reference to it). So I think some rewor= ding is needed here, specially because router vendors sorted out those bugs= long time ago. 2.1.4. Temporary Addresses - Privacy Extensions for SLAAC I will add, that "In those cases where accounting/auditing/extreme granular= security is required, because is impractical to use DHCPv6 due to the lack= of support in Android based OSs, link-layer security such as IEEE802.1x ma= y be used." 2.1.6. DHCP/DNS Considerations This probably belongs to another section (may be a specific one for DNS), b= ut related: "If there is a need for Statically Configured Addresses, it should consider= ed using DNS to refer to them, so no hard-coded addresses are used by appli= cations. This facilitates also debugging/troubleshooting as avoids remember= ing addresses. In may be advisable to have multiple-faced DNS ("views") in = order to ensure that internal-only used hosts, aren't published globally an= d full zone transfers are disallowed." 2.1.7. Using a /64 per host I will add: "This also avoids the need to "proxy" or NAT-like operations if multiple VM= s, containers, or similar ones, need their own IPv6 address from a single /= 64 ." Regards, Jordi =EF=BB=BFEl 29/3/19 6:19, "v6ops en nombre de Fred Baker" escribi=C3=B3: Yesterday, the authors of an opec draft asked us for comments on their d= raft, which is in a second WGLC in opec (opsec@ietf.org). You may have miss= ed the character string: https://datatracker.ietf.org/doc/draft-ietf-opsec-v6 https://tools.ietf.org/html/draft-ietf-opsec-v6 "Operational Security Considerations for IPv6 Networks", Eric Vyncke, Chittimaneni Kk, Merike Kaeo, Enno Rey, 2019-03-11, I'd encourage people to read it and comment on the opec list. ------------------------------------------------------------------------= -------- Victorious warriors win first and then go to war, Defeated warriors go to war first and then seek to win. Sun Tzu _______________________________________________ v6ops mailing list v6ops@ietf.org https://www.ietf.org/mailman/listinfo/v6ops ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or con= fidential. The information is intended to be for the exclusive use of the i= ndividual(s) named above and further non-explicilty authorized disclosure, = copying, distribution or use of the contents of this information, even if p= artially, including attached files, is strictly prohibited and will be cons= idered a criminal offense. If you are not the intended recipient be aware t= hat any disclosure, copying, distribution or use of the contents of this in= formation, even if partially, including attached files, is strictly prohibi= ted, will be considered a criminal offense, so you must reply to the origin= al sender to inform about this communication and delete it. _______________________________________________ v6ops mailing list v6ops@ietf.org https://www.ietf.org/mailman/listinfo/v6ops =20 ---------------------------------------------------------------------------= ----- The fact that there is a highway to hell and a stairway to heaven is an int= eresting comment on projected traffic volume... ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or con= fidential. The information is intended to be for the exclusive use of the i= ndividual(s) named above and further non-explicilty authorized disclosure, = copying, distribution or use of the contents of this information, even if p= artially, including attached files, is strictly prohibited and will be cons= idered a criminal offense. If you are not the intended recipient be aware t= hat any disclosure, copying, distribution or use of the contents of this in= formation, even if partially, including attached files, is strictly prohibi= ted, will be considered a criminal offense, so you must reply to the origin= al sender to inform about this communication and delete it. --B_3636790973_1769206433 Content-type: text/html; charset="UTF-8" Content-transfer-encoding: quoted-printable

Sorry about that, just clicked reply!

 

I=E2=80=99m working already, hopefully finish today, to review the ot= her 40 pages. It is a really long document! May be I will break it down in = several parts.

 

I will make sure to submit to opsec this time!


Regards,

Jordi

 =

 

 

El 30/3/19 11:33, "Fred Baker" <fredbaker.ietf@gmail.com> e= scribi=C3=B3:

 

This was sent to v6ops instead of opsec<= /p>



Subject: Re: [v6ops] = draft-ietf-opsec-v6

Date: March 29,= 2019 at 5:13:32 PM GMT+1

To: IPv6 Oper= ations <v6ops@ietf.org><= o:p>

=  

Hi all,

Thanks for the reminder, overdue task for me for a while ..= . So here is it (partially, as I'm working in the plane, so more in followi= ng emails).

2.1.  Addressing Architecture

  On= ce an address allocation has been assigned, there should be some
 &= nbsp;thought given to an overall address allocation plan.  With the  abundance of address space available, an address allocation ma= y be
  structured around services along with geographic locati= ons, which
  then can be a basis for more structured security = policies to permit
  or deny services between geographic regio= ns.

One of MOST frequent issues when you start implementing IPv6 is = that people tend to go to their RIR for a default allocation/assignment, an= d then try to make the addressing plan with what they have, instead of plan= ning correctly and then going to the RIR. The result is many cases is ISPs providing a single /64 to customers, whic= h is really bad.

Also, if the document is for operators and enterpri= ses, you need to differentiate among allocation and assignment.

So, = I will like to suggest rewording as:
"A key task before starting an= IPv6 deployment, once the sufficient knowledge has been acquired, is to pr= epare an addressing plan. With the abundance of address space available, an= addressing plan may be structured around services along with geographic lo= cations, which then can be a basis for more structured security policies to= permit or deny services between geographic regions.

This may be see= n as a simple task, but it is an activity within the IPv6 deployment projec= t, that requires a very in depth thinking and it makes sense to invest as m= uch time as required on it. Only once that addressing plan has been designe= d is the right time to go to the relevant Regional Internet Registry (RIR) = to ask for an allocation or an assignment."

Then, in the next p= .:

  A common question is whether companies should use Pro= vider
  Independent (PI) vs Provider Allocated (PA) space [RFC= 7381], but from
  a security perspective there is little diffe= rence.

Replace with

"A common question is whether compan= ies should use Provider Independent (PI) vs Provider Allocated (PA) space [= RFC7381], but from a security perspective there is little difference. From = the RIRs policies perspective, PI space is assigned to organizations if the= y don't need to sub-assign to third parties, while PA is allocated to opera= tors or organizations that will sub-assign to third parties. For example, a= big corporation may have different subsidiaries and they are legally diffe= rent entities, so in this case each one need their own PI space, or the res= ponsible for the network need to get allocated PA space. A public instituti= on such as a Ministry, may get a PI, if is only for their own use and not f= or other government institutions, however if it is the government entity ma= naging the network that interconnects several institutions and provide each= one their own space, they need to obtain PA space."

And contin= ue with "However, one ..." in a new p.

2.1.1.  Static= ally Configured Addresses

Nit:
The use of well-known(such
The = use of well-known (such

There are many scanning techniques and more = to
  come possible, hence, operators should never relly on the= 'impossible
  to find because my address is random' paradigm.=

I will say:

There are many scanning techniques and more to  come possible, hence, operators should never relly on the 'im= possible
  to find because my address is random' paradigm, eve= n if it is a good practice to have the statically configured addresses rand= omly distributed across the /64 subnets and use always DNS.

2.1.2. &= nbsp;Use of ULAs

I will add:

"Even if today a network is= not connected to Internet, and it looks like it will not be in the future,= things change and it is a considerable effort to renumber it. So it may be= relevant to obtain an IPv6 PI assignment from the RIR and have a stable ad= dressing space since day one."

2.1.3.  Point-to-Point Link= s

I disagree with the mention that RFC6164 indicate that /127 is the= way. RFC6164 is about "routers must support it". See draft-palet= -v6ops-p2p-links (new version coming soon, so may be a reference to it). So= I think some rewording is needed here, specially because router vendors so= rted out those bugs long time ago.

2.1.4.  Temporary Addresses = - Privacy Extensions for SLAAC

I will add, that "In those cases= where accounting/auditing/extreme granular security is required, because i= s impractical to use DHCPv6 due to the lack of support in Android based OSs= , link-layer security such as IEEE802.1x may be used."

2.1.6. &= nbsp;DHCP/DNS Considerations

This probably belongs to another section (may be a specific one for DNS), but re= lated:

"If there is a need for Statically Configured Addresses,= it should considered using DNS to refer to them, so no hard-coded addresse= s are used by applications. This facilitates also debugging/troubleshooting= as avoids remembering addresses. In may be advisable to have multiple-face= d DNS ("views") in order to ensure that internal-only used hosts,= aren't published globally and full zone transfers are disallowed."
2.1.7.  Using a /64 per host

I will add:

"This= also avoids the need to "proxy" or NAT-like operations if multip= le VMs, containers, or similar ones, need their own IPv6 address from a sin= gle /64 ."

Regards,
Jordi



=EF=BB=BFEl 29/3/19= 6:19, "v6ops en nombre de Fred Baker" <v6ops-bounces@ietf.org en nombre de fredbaker.ietf@gmail.com> escribi=C3=B3= :

   Yesterday, the authors of an opec draft asked us= for comments on their draft, which is in a second WGLC in opec (opsec@ietf.org). You may have missed the charac= ter string:

   https://datatracker.ietf.org/doc/draft-ietf-opse= c-v6
   https://tools.ietf.org/html/draft-ietf-opsec-v6
 = ;    "Operational Security Considerations for IPv6= Networks", Eric Vyncke,
     Chittimaneni= Kk, Merike Kaeo, Enno Rey, 2019-03-11,

   I'd encour= age people to read it and comment on the opec list.

  &nbs= p;-------------------------------------------------------------------------= -------
   Victorious warriors win first and then go to w= ar,
   Defeated warriors go to war first and then seek to= win.
        Sun Tzu

&nb= sp;  _______________________________________________
 &nb= sp; v6ops mailing list
   v6ops@ietf.org
   https://www.ietf.org/mailman/listinfo/v6ops




**********************************************
IPv4= is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company
This electronic message contains information which may be privileged o= r confidential. The information is intended to be for the exclusive use of = the individual(s) named above and further non-explicilty authorized disclos= ure, copying, distribution or use of the contents of this information, even= if partially, including attached files, is strictly prohibited and will be= considered a criminal offense. If you are not the intended recipient be aw= are that any disclosure, copying, distribution or use of the contents of th= is information, even if partially, including attached files, is strictly pr= ohibited, will be considered a criminal offense, so you must reply to the o= riginal sender to inform about this communication and delete it.


_______________________________________________
v6ops mailing list<= br>v6ops@ietf.org
https://www.ietf.org/mailman/listinfo/v6ops=

 

-------------------------------------------------= -------------------------------

The fact that there is a highway to hell and a= stairway to heaven is an interesting comment on projected traffic volume..= .




********************************= **************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or con= fidential. The information is intended to be for the exclusive use of the i= ndividual(s) named above and further non-explicilty authorized disclosure, = copying, distribution or use of the contents of this information, even if p= artially, including attached files, is strictly prohibited and will be cons= idered a criminal offense. If you are not the intended recipient be aware t= hat any disclosure, copying, distribution or use of the contents of this in= formation, even if partially, including attached files, is strictly prohibi= ted, will be considered a criminal offense, so you must reply to the origin= al sender to inform about this communication and delete it.

--B_3636790973_1769206433-- From nobody Sat Mar 30 06:29:58 2019 Return-Path: X-Original-To: opsec@ietfa.amsl.com Delivered-To: opsec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id CEF9D1201A7 for ; Sat, 30 Mar 2019 06:29:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.999 X-Spam-Level: X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=consulintel.es Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mE94zJ5aQ74f for ; Sat, 30 Mar 2019 06:29:55 -0700 (PDT) Received: from mail.consulintel.es (mail.consulintel.es [IPv6:2001:470:1f09:495::5]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 84FD11201B1 for ; Sat, 30 Mar 2019 06:29:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=consulintel.es; s=MDaemon; t=1553952590; x=1554557390; i=jordi.palet@consulintel.es; q=dns/txt; h=User-Agent:Date: Subject:From:To:Message-ID:Thread-Topic:Mime-version: Content-type:Content-transfer-encoding; bh=W1+gRrxnMljAYq1yzejgy PE4kwUe/biohiWx7MqzirY=; b=XkeokOwHpGkpRqhFdvztnzxN1pFkcw2n959C/ 14SejpOreq7WXKXDfxxEletqelHIAXz/43vKRI2oQIzp1f/zqgZjexfWCQFrtSzz z36TQX3W56XzMoBXSbjXsVrM8hq7D+jdYKnxS9XsSwU17h4y40/5sWAiIOnEjwIq XpURFA= X-MDAV-Result: clean X-MDAV-Processed: mail.consulintel.es, Sat, 30 Mar 2019 14:29:50 +0100 X-Spam-Processed: mail.consulintel.es, Sat, 30 Mar 2019 14:29:50 +0100 Received: from [10.10.10.139] by mail.consulintel.es (MDaemon PRO v16.5.2) with ESMTPA id md50006203508.msg for ; Sat, 30 Mar 2019 14:29:48 +0100 X-MDRemoteIP: 2001:470:1f09:495:89b:85cd:3d1f:ae66 X-MDHelo: [10.10.10.139] X-MDArrival-Date: Sat, 30 Mar 2019 14:29:48 +0100 X-Authenticated-Sender: jordi.palet@consulintel.es X-Return-Path: prvs=19925d7c34=jordi.palet@consulintel.es X-Envelope-From: jordi.palet@consulintel.es X-MDaemon-Deliver-To: opsec@ietf.org User-Agent: Microsoft-MacOutlook/10.10.8.190312 Date: Sat, 30 Mar 2019 14:29:44 +0100 From: JORDI PALET MARTINEZ To: Message-ID: Thread-Topic: [OPSEC] draft-ietf-opsec-v6 Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: 7bit Archived-At: Subject: Re: [OPSEC] draft-ietf-opsec-v6 X-BeenThere: opsec@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: opsec wg mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Mar 2019 13:29:58 -0000 Additional inputs follow. I will follow the discussion if anything else need to be clarified. 2.3.3. Securing DHCP Dynamic Host Configuration Protocol for IPv6 (DHCPv6), as originally detailed in [RFC3315] now obsoleted by [RFC8415] I think it should mention directly RFC8415, not the older document, as in case it is needed, RFC8415 already have the reference to the older one, updates, etc. Same across the complete document, replace 3315 with 8415. 2.3.4. 3GPP Link-Layer Security Even if is not common today, DHCPv6 and -PD are also supported in 3GPP, so may be a reference to the same considerations that apply in that case from DHCP scenarios? 2.5.1. Authenticating Neighbors/Peers Similar comment: [RFC7166] (which obsoletes [RFC6506] I don't think across the text it makes sense to refer to the obsoleted/updated documents, unless there anything that need to be taken in consideration, as all the "new" documents will already mention the older ones. I've seen this in at least 5 more places across the text. 2.6. Logging/Monitoring In "Please note that there are privacy issues related to how those logs are collected, kept and safely discarded. Operators are urged to check their country legislation." You may want to point to something very specific, at least as an example, as GDPR, as it may have many "new" implications. Also, cases where some technologies can't be deployed in some countries, because they lack of compliance about the minimum data to be logged. 2.6.1.6. RADIUS Accounting Log Nit: [IEEE-802.1X]wired -> [IEEE-802.1X] wired 2.6.2.2. Inventory Nit: such packets... -> such packets. 2.7.1. Dual Stack Nit: are provided in Section 2.8 -> are provided in Section 2.8. Can't parse: global IPv6 address is rogue RA I think it means: global IPv6 address if rogue RA 2.7.2. Transition Mechanisms There are many tunnels used for specific use cases. Except when protected by IPsec [RFC4301], all those tunnels have a couple of security issues (most of them because they are tunnels and are described in RFC 6169 Maybe reads better this way: There are many tunnels used for specific use cases. Except when protected by IPsec [RFC4301], all those tunnels have a couple of security issues, most of them because the fact of being tunnels as described in RFC 6169 traffic interception: no confidentiality is provided by the tunnel protocols (without the use of IPsec) replace with: traffic interception: no confidentiality is provided by the tunnel protocols (without the use of IPsec or alternative methods) Also, one more nit, for consistence in this section (I've seen this in other parts of the document), some bullets finish with ";" others with ".". No mention to 6over4 (RFC2529)? The full section intro seems to care about "IPv6 in IPv4". Not sure if in the same section, or a different one, there should be some text considering that this will turn around, may be is needed to care about IPv4 in IPv6? 2.7.2.8. Teredo Teredo is now mostly never used and it is no more automated in most environment, so, it is less of a threat. I think this is somehow incomplete, in the sense that many users/enterprises are still running very old or non-updated OSs. A warning on that can make it: Teredo is now mostly never used and it is no more automated in most environment, so, it is less of a threat, however, special consideration must be taken in case of devices with older or non-updated operating systems may be present, which by default were running Teredo. May be a similar text can be used as well for 6to4 (2.7.2.7. 6to4). May be some considerations for LDPv6 in a specific section, such as done for 2.7.2.4. 6PE and 6VPE. Some mechanisms do translation and encapsulation, so some text to explain that both security risk-sets can apply there. Also, after reading all those sections, I've a suggestion. I don't think "2.7.2. Transition Mechanisms" is the right title for that section. This is already part of "2.7. Transition/Coexistence Technologies". I will suggest: 2.7.2. Encapsulation Mechanisms 2.7.3.1. Carrier-Grade Nat (CGN) May be 2.7.3.1. Carrier-Grade NAT (CGN) I think a reference to the wording AFTR needs also to be included as per RFC6333. For example: Address Family Transition Router (AFTR, RFC6333), Carrier-Grade NAT (CGN), also called NAT444 CGN ... 2.7.2.6. Mapping of Address and Port I understand the way you organized those, but because MAP-T and MAP-E have different implications (translation vs encapsulation), I will suggest to either split it, even if text is partially duplicated, or at least have a sub-section in the translation section for MAP-T with a reference to this. 2.7.3.2. NAT64/DNS64 Either a new section for 464XLAT, or a p. and change the section title: 2.7.3.2. NAT64/DNS64 and 464XLAT 464XLAT (RFC6877) shares the same security considerations as NAT64 and DNS64, however it can be used without DNS64, avoiding the DNSSEC implications. May be a reference to draft-ietf-v6ops-nat64-deployment, is useful. Also a mitigation, in some cases to avoid everything to be translated by the NAT64 is the use of EAMT (RFC7757). Missing lw4o6 (RFC7596) section as well? May be some generic considerations for IPv6-only and IPv4-as-a-Service (draft-ietf-v6ops-transition-ipv4aas), such as the need to include a DNS-proxy in devices running the transition mechanism. One more suggestion. Reorder alphabetically the sub-sections, for example, the encapsulation mechanisms, the translation mechanisms, etc. It may be worth to look into that in the rest of the document as well. 3.2. Internal Security Considerations: As mentioned in Section 2.6.2, care must be taken when running automated IPv6-in-IP4 tunnels. Some text also about IPv4-in-IPv6? What about allowing/disallowing VPNs (yes, it is a tunnel, but explicit mention)? Nit: provided in Section 2.8 -> provided in Section 2.8. 4.1. BGP Is not just prefix filtering, also boggon ASN filtering. Add a recommendation for RPKI and strong filtering to avoid hijacking (both for 3rd parties and boggons of IPv4, IPv6 and ASN). 5. Residential Users Security Considerations Replace If the Residential Gateway has IPv6 connectivity, [RFC7084] (that obsoletes [RFC6204]) defines the requirements of an IPv6 CPE and does not take position on the debate of default IPv6 security policy as defined in [RFC6092]: with If the Residential Gateway has IPv6 connectivity, [RFC7084] and draft-ietf-v6ops-transition-ipv4aas define the requirements of an IPv6 CPE and does not take position on the debate of default IPv6 security policy as defined in [RFC6092]: I think in this section, it makes sense a reference to Section 5. UPnP Support of draft-ietf-v6ops-transition-ipv4aas, which also includes a reference to PCP support. Final inputs: 1) Should the document have a special mention that in IPv6 it doesn't make sense, and it has negative implications the complete filtering of ICMP, and instead use rate limiting, or filter only echo/reply? 2) I never thought about it, but maybe there are some (or in some scenarios) implications because Happy Eyeballs, that need to be considered ? ********************************************** IPv4 is over Are you ready for the new Internet ? http://www.theipv6company.com The IPv6 Company This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.