Subject: [secdir] Secdir review of draft-iana-rfc3330bis-06

From: Paul Hoffman <[email-masked]>
Date: Mon, 30 Mar 2009 09:28:14 -0700

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

This is essentially a security-free document. Having said that, the one paragraph in the Security Considerations section could use a bit of clarification. It says:

   The particular assigned values of special-use IPv4 addresses
   cataloged in this document do not directly raise security issues.
   However, the Internet does not inherently protect against abuse of
   these addresses; if you expect (for instance) that all packets from
   the 10.0.0.0/8 block originate within your subnet, all border routers
   should filter such packets that originate from elsewhere.  Attacks
   have been mounted that depend on the unexpected use of some of these
   addresses.

I think that "all packets from the 10.0.0.0/8 block" should be "all packets from a private address space such as the 10.0.0.0/8 block or the link local block 169.254.0.0/16".

Also, I believe that "all border routers should filter such packets that originate from elsewhere" should be "all routers at the border of your network should filter such packets that originate from outside your network".

Please also note the messages on ietf-general from this past weekend; having another example block would help many IETF documents.

--Paul Hoffman, Director
--VPN Consortium