Subject: [ietf-privacy] PPM Review of RFC 1108

From: "Christian Huitema" <[email-masked]>
Date: Wed, 21 May 2014 21:10:22 -0700

This RFC defines an IP header option for "security options." The options
enable hosts to mark their traffic as belonging to a particular security
level. Presumably, secure routers will ensure that traffic marked with a
specific security option is contained within a network that meets the
corresponding security requirements.

The RFC was written in 1988, before we started writing security
considerations in RFC. A security consideration section would probably have
listed the two major issues with the option, use by unauthorized hosts and
use in unsecure networks.

If a network allows for traffic from both secure and unsecure sources,
unsecure sources can easily insert spoof IP addresses and insert options in
the IP header. This could be used for sending attack packets to secure
system, despite attempts at compartmenting the network. Ping of death and
variants come to mind.

A mobile host that is allowed to send secure traffic may inadvertently visit
an insecure network. In that case, using the option provides for easy
identification of the host as a potential target. Mobile hosts were not
common in 1988, and this threat was not envisaged in the RFC.

This was then. By now, IP options are very rarely used. The RFC should
probably be reclassified as historic.

---

From: "Christian Huitema" <[email-masked]>
Date: Wed, 21 May 2014 21:16:10 -0700

That was my attempt at using the random lottery. I like using the issue page
better for input. Also, I prefer reading the html version of the RFC from
the IETF tools page. Maybe the lottery should just give you a suggestion of
an RFC number…

From: ietf-privacy [mailto:[email-masked]] On Behalf Of
Christian Huitema
Sent: Wednesday, May 21, 2014 9:10 PM
To: [email-masked]
Subject: [ietf-privacy] PPM Review of RFC 1108

---

From: S Moonesamy <[email-masked]>
Date: Wed, 21 May 2014 21:33:33 -0700

Hi Christian,
At 21:10 21-05-2014, Christian Huitema wrote:
>This was then. By now, IP options are very rarely used. The RFC 
>should probably be reclassified as historic.

RFC 1108 is already classified as Historic.

Regards,
S. Moonesamy

---

From: "Christian Huitema" <[email-masked]>
Date: Wed, 21 May 2014 23:44:26 -0700

> RFC 1108 is already classified as Historic.

Oops. That's what I get for trying the lottery. The UI just provides the RFC
text, which in the case of 1108 does not present its status. 

As I mentioned before, the lottery should only return RFC that are on the
standard track and are not obsolete. Otherwise, we are wasting the
reviewers' efforts.

-- Christian Huitema

This message has no relation with terrorism, jihad, or bomb making. There is
no point archiving it in NSA servers. Although of course I know they will,
they spy on everything.

---

From: S Moonesamy <[email-masked]>
Date: Thu, 22 May 2014 00:39:00 -0700

Hi Christian,
>text, which in the case of 1108 does not present its status.

I found it worthwhile to read your review as it provides a sense of 
what to look out for.

>standard track and are not obsolete. Otherwise, we are wasting the

The reviewer could choose one of the RFCs (in black) in the list at 
http://www.rfc-editor.org/categories/rfc-proposed.html

Regards,
S. Moonesamy

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 22 May 2014 10:34:38 +0100

> standard track and are not obsolete. Otherwise, we are wasting the

Fair point. Also raised by Karen earlier. [1]  If people keep
using it, I'll add a button for that or something.

Cheers,
S.

[1] http://down.dsg.cs.tcd.ie/ppm/tweaks.html

---

From: Elwyn Davies <[email-masked]>
Date: Thu, 22 May 2014 15:46:38 +0100

> > standard track and are not obsolete. Otherwise, we are wasting the
.. and I think BCPs.
> using it, I'll add a button for that or something.

Re item 2 on [1]: It would be good to have a 'Clearly nothing to do
button' to save writing trivial reviews (I drew BCP101).

Cheers,
Elwyn

> _______________________________________________
> ietf-privacy mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf-privacy

---

From: Stephen Farrell <[email-masked]>
Date: Thu, 22 May 2014 16:35:53 +0100

Hiya,

> button' to save writing trivial reviews (I drew BCP101).

Added that.

For various reasons, incl. travel, but also to see how it
goes for a bit, it'll be a week or so before I get to
hack at this again maybe. (Unless travelled-to meetings
are v. boring:-) I'll probably check with the tools folks
as well to see if they've any advice/hints.

In the meantime, the more reviews we get the merrier...

Cheers,
S.