Subject: Re: [secdir] [Roll] Secdir review of draft-ietf-roll-mpl-parameter-configuration-04

From: Yusuke DOI <[email-masked]>
Date: Thu, 02 Jul 2015 18:25:11 +0900

Brian,

Thank you very much for your review. I submitted revised version (-06, not -05, sorry for unfixed nits).

On 2015-06-26 05:18, Brian Weis (bew) wrote:
> 1. Describing a resource consumption threat ("excessive layer-2
> broadcasting“) resulting from a man-in-the-middle modifying policy
> sent within an option. If there is a suggested mitigation (e.g., a
> means of integrity protecting the DHCPv6 traffic between the client
> and server) this would be worth noting. But I’m not sure if there
> any available mitigation in a ROLL environment.

I added some text on network level protection case in addition to use of DHCPv6 security, including filter on the border router in a ROLL network.

> 2. Making a requirement that a server implementation choose
> reasonable policy values. This might be more useful if it were
> phrased as a threat, something like “Server implementations need to
> take care in setting reasonable bounds for each parameter in order to
> avoid overloading the network."

Thanks. I used your text with 'server and client implementations.'

> 3. Making a requirement that the "DHCP server or the network itself
> shall be trusted by some means including network access control or
> DHCP authentication”.  Is this this “shall” intended to be an RFC
> 2119  “MUST”?

No. I think making secure network properly to use DHCPv6 option is just a generic requirement and it's beyond the scope of this document.

Best Regards,

Yusuke