Subject: (ngtrans) DSTM VPN comments

From: Pekka Savola <[email-masked]>
Date: Sun, 17 Mar 2002 15:44:24 +0200 (EET)

Hi,

A couple of comments to DSTM VPN draft.  Note: Authors Addresses section 
is missing...

   The investissement for sites is minimal, it requires an access to the
   IPv6 Internet through native links or tunnels and the installation of
   a TEP and a DSTM server. It can also be possible to locate this
   mechanism in another part of the network, which may be runned by a
   third party.

==> should be investment?

3. Security Considerations

   The main difference between the intranet scenario and the VPN
   scenario of DSTM is security. In the intranet scenario, the request
   for a temporary IPv4 address may not be authenticated since DSTM
   hosts are located inside an Intranet.

==> bad wording: "may not be authenticated" -> "is not necessarily 
required to be authenticated" or something.

   The mapping between the IPv4 and IPv6 address of the DSTM node in the
   TEP is also a security concern. If the mapping is established
   dynamically (no configuration by the DSTM server), it could be
   possible for every intruder knowing a valid temporary IPv4 address to
   use the TEP as an IPv4 relay or to access internal IPv4 ressources.
   So, in the VPN scenario, the mapping in the TEP MUST be managed by
   the DSTM server which authenticates the DSTM host and its IPv6
   address.

==> this brings up the old problem with more or less blind decapsulation 
of tunnel packets.

This is especially nasty when coupled with DSTM ND-mechanism.

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords