[secdir] Secdir review of draft-iana-rfc3330bis-06

Paul Hoffman <paul.hoffman@vpnc.org> Mon, 30 March 2009 16:27 UTC

Mime-Version: 1.0
Message-Id: <p0624082ec5f6a14f36f4@[10.20.30.158]>
Date: Mon, 30 Mar 2009 09:28:14 -0700
To: secdir@ietf.org
From: Paul Hoffman <paul.hoffman@vpnc.org>
Content-Type: text/plain; charset="us-ascii"
Cc: leo.vegoda@icann.org, michelle.cotton@icann.org
Subject: [secdir] Secdir review of draft-iana-rfc3330bis-06
Precedence: list

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

This is essentially a security-free document. Having said that, the one paragraph in the Security Considerations section could use a bit of clarification. It says:

The particular assigned values of special-use IPv4 addresses
cataloged in this document do not directly raise security issues.
However, the Internet does not inherently protect against abuse of
these addresses; if you expect (for instance) that all packets from
the 10.0.0.0/8 block originate within your subnet, all border routers
should filter such packets that originate from elsewhere. Attacks
have been mounted that depend on the unexpected use of some of these
addresses.

I think that "all packets from the 10.0.0.0/8 block" should be "all packets from a private address space such as the 10.0.0.0/8 block or the link local block 169.254.0.0/16".

Also, I believe that "all border routers should filter such packets that originate from elsewhere" should be "all routers at the border of your network should filter such packets that originate from outside your network".

Please also note the messages on ietf-general from this past weekend; having another example block would help many IETF documents.

--Paul Hoffman, Director
--VPN Consortium

[secdir] Secdir review of draft-iana-rfc3330bis-06 Paul Hoffman