Subject: [Gen-art] Gen-ART review of draft-ietf-v6ops-addr-select-req-04.txt

From: "Vijay K. Gurbani" <[email-masked]>
Date: Fri, 01 Feb 2008 15:32:18 -0600

I have been selected as the General Area Review Team (Gen-ART)
reviewer for this draft (for background on Gen-ART, please see
http://www.alvestrand.no/ietf/gen/art/gen-art-FAQ.html).

Please wait for direction from your document shepherd
or AD before posting a new version of the draft.

Document: draft-ietf-v6ops-addr-select-req-04.txt
Reviewer: Vijay K. Gurbani
Review Date: 1 Feb 2008
IESG Telechat date: 7 Feb 2008

Summary: This draft is ready for publication as an Informational.

One quick question: Isn't it the case that the six
threats enumerated in S3.1 would exist irrespective of the new
address-selection mechanism; i.e., the new address-selection
mechanism does not make things any worse than they already are.
It may be worth highlight the cases where the address-selection
mechanism renders any existing threat more insidious, or introduces
a brand new set of threats.

Thanks,

- vijay
-- 
Vijay K. Gurbani, Bell Laboratories, Alcatel-Lucent
2701 Lucent Lane, Rm. 9F-546, Lisle, Illinois 60532 (USA)
Email: vkg@{alcatel-lucent.com,bell-labs.com,acm.org}
WWW:   http://www.alcatel-lucent.com/bell-labs
_______________________________________________
Gen-art mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/gen-art

---

From: "Vijay K. Gurbani" <[email-masked]>
Date: Wed, 06 Feb 2008 09:01:34 -0600

Arifumi Matsumoto wrote:
> Some of these are not new and not introduced by one or multiple
> address-selection mechanisms.
> 
> However, all the items in the lists in S3.1 are the threats that are
> new and specific to the address-selection mechanisms in a sense. 

Ah, OK.  In that case, to answer your next question:

> How should we describe such a case in the security consideration 
> section ?

I will float some suggested text that you are more than welcome
to wordsmith:

OLD:
    3.1. List of threats introduced by new address-selection mechanism

      There are some security incidents when combining these
      requirements described in Section 2 into a protocol.  In
      particular, here are six possible threats.

NEW:
    3.1. List of threats introduced by new address-selection mechanism

      The need to address the requirements described in Section 2
      into a protocol may expose such a protocol to new threats.
      In particular, here are six possible threats that such a
      protocol may be vulnerable to:

Thanks,

- vijay

---

From: Arifumi Matsumoto <[email-masked]>
Date: Thu, 07 Feb 2008 10:55:54 +0900

Hi Vijay,

thank you for your suggestion.
Though I'm far from being a wordsmith, I got that your text
clarifies your points of concern better.

Thank you. :)

-- 
Arifumi Matsumoto
    IP Technology Expert Team
    Secure Communication Project
    NTT Information Sharing Platform Laboratories
    E-mail: [email-masked]

---

From: Arifumi Matsumoto <[email-masked]>
Date: Wed, 06 Feb 2008 16:35:18 +0900

Hi Vijay,
let me thank you for your generous efforts
as an Gen-ART team member.

> a brand new set of threats.

Some of these are not new and not introduced
by one or multiple address-selection mechanisms.

However, all the items in the lists in S3.1 are the threats
that are new and specific to the address-selection mechanisms
in a sense. 

For example, item #2 "Malicious changing of policy data by 
nonapproved nodes." assumes the existense of disguised policy
distribution server. As we don't have or use such a mechansim
right now, we don't have such a new threat of malicious policy
injection. But in a much broader sense, we have several mechanisms
to distribute some kind of policy into the hosts and these
mechanisms already face this threat. One sure thing is that
by making a policy distributing mechanism there will be another
new way to inject malicious policy to hosts.

Best regards,