Subject: Re: [secdir] Clarification question on draft-ietf-6man-dns-options-bis-06

From: Jaehoon Jeong <[email-masked]>
Date: Sat, 10 Jul 2010 20:31:29 -0600

Hi Tony,
Thanks for this update.

If this draft can support the identification of DNS option source, I will refer to this draft in the next revision of our draft.

Best Regards,
Paul

-----Original Message-----
From: Tony Cheneau [mailto:[email-masked]] 
Sent: Saturday, July 10, 2010 9:55 AM
To: [email-masked]
Subject: Clarification question on draft-ietf-6man-dns-options-bis-06

Hello,

I read your document and I have the following comment on the Security Consideration section. (I know it may be a late comment due to the IESG
processing...)

The document states:
    If the Secure Neighbor Discovery (SEND) protocol [RFC3971] is used as
    a security mechanism for ND, all the ND options including the RDNSS
    and DNSSL options are automatically included in the signatures, so
    the transport for the RA options is integrity-protected; that is,
    SEND can prevent the spoofing of these DNS options with signatures.
    Also, SEND enables an IPv6 host to verify that the sender of an RA is
    actually a router authorized to act as a router.  However, since any
    valid SEND router can still insert RDNSS and DNSSL options, SEND
    cannot verify which one is or is not authorized to send the options.

I agree that currently SEND does not provide any mechanism to indicate if a router can or cannot insert RDNSS and DNSSL options. However, I think the document draft-ietf-csi-send-cert-05 could help with that issue. The section 7 of the document describes Extended Key Usage for the certificate deployed in SEND.  While it currently defines roles for Routers, Routers acting as Proxy and Address Owner, I think it could be extended to a new usage that indicates that the Router was indeed authorized to insert RDNSS and DNSSL options.

Hope it helps.

Best regards,
 	Tony Cheneau

_______________________________________________
secdir mailing list
[email-masked]
https://mailman.mit.edu/mailman/listinfo/secdir