Subject: Re: [secdir] secdir review of draft-ietf-v6ops-tunnel-loops-01

From: Tom Yu <[email-masked]>
Date: Mon, 03 Jan 2011 15:00:45 -0500

Fred Baker <[email-masked]> writes:

> Question for you. I have left the authors off the paper for the moment.
>
> Mr Gont has recently posted a draft:
>
> http://tools.ietf.org/html/draft-gont-6man-teredo-loops
>   "Mitigating Teredo Rooting Loop Attacks", Fernando Gont, 7-Sep-10,
>   <draft-gont-6man-teredo-loops-00.txt>
>
> and is pushing for adoption as a working group draft. When asked to
> consider merging his paper with this or another draft, he has been
> unwilling. The chairs have basically told him to discuss his draft
> on the list "and we'll see where it goes".

The draft filename implies 6man, not v6ops; which working group was
asked to consider it?  By "his paper", do you mean the following item
in the Informative References of draft-gont-6man-teredo-loops-00?

   [CPNI-IPv6]
              Gont, F., "Security Assessment of the Internet Protocol
              version 6 (IPv6)",  UK Centre for the Protection of
              National Infrastructure, (to be published).

The Teredo attacks and the protocol-41 attacks appear to be mostly
separate, and probably don't interact, with the possible exception of
using a protocol-41 tunnel to initiate a Teredo routing loop attack.

> One of your criticisms of this draft is that it doesn't cover his
> USENIX material. Would you prefer that this and Mr Gont's draft be
> merged?

A reader of this draft might erroneously conclude that it adequately
addresses all of the attacks described in the USENIX paper.  However,
I think it's sufficient to mention the existence of the Teredo
attacks, citing the USENIX paper and the Teredo routing loop draft,
because someone who reads draft-ietf-v6ops-tunnel-loops might not be
aware of the related attacks without reading the actual USENIX paper.

It would also be a good idea to briefly state that the Teredo attacks
are mostly separate from the protocol-41 attacks, and are therefore
treated in another document.

---

From: Fred Baker <[email-masked]>
Date: Mon, 3 Jan 2011 12:15:38 -0800

> in the Informative References of draft-gont-6man-teredo-loops-00?

True. he has none-the-less been asking me to make it a v6ops working group draft.

> aware of the related attacks without reading the actual USENIX paper.

So you're simply looking for a reference? OK.

> treated in another document.

OK.

---

From: Tom Yu <[email-masked]>
Date: Mon, 03 Jan 2011 16:29:39 -0500

> So you're simply looking for a reference? OK.

And sufficient text that the reader will be aware that not all of the
attacks (Teredo) described in the USENIX paper are addressed in this
document.

---

From: Gabi Nakibly <[email-masked]>
Date: Mon, 10 Jan 2011 23:05:05 -0800 (PST)

Hi Tom,
Thanks for the valuable input. See our reponse inline.

Fred and Gabi

----- Original Message ----
> From: Tom Yu <[email-masked]>
> To: [email-masked]; [email-masked]; 
>[email-masked]
> Sent: Thu, December 30, 2010 6:00:24 AM
> Subject: secdir review of draft-ietf-v6ops-tunnel-loops-01
> 
> This document describes routing loop vulnerabilities inherent in the
> existing design of IPv6-in-IPv4 tunneling protocols, and suggests
> mitigation strategies.
> 
> While the Security Considerations section of this document claims that
> the recommended checks do not introduce new security threats, Section
> 3.1 mentions that the additional processing overhead for checking
> destination and source addresses may be considerable.  It would be
> useful to have measurements or estimates of how this additional
> processing overhead compares to the effects of the routing loop attack
> that it is intended to mitigate.

Such estimates will be added to the Security Considerations section.

> 
> This document makes no mention of the Teredo attacks that are
> discussed in the USENIX WOOT paper.  The authors may wish to mention
> draft-gont-6man-teredo-loops-00 for the sake of completeness.
> 

We will cite this draft.

> Editorial:
> 
> Section 3 lists three categories of mitigation measures but the
> accompanying text states that they fall under two categories.
> 
> In Section 3.1, in the sentence "However, this approach has some
> inherit limitations", replace "inherit" with "inherent".
> 
> In Section 4, in the sentence "...other mitigation measures may be
> allowed is specific deployment scenarios", replace "may be allowed is"
> with "may be feasible in".
> 

All these will be corrected.