[secdir] secdir review of draft-iana-ipv4-examples-01

Barry Leiba <barryleiba.mailing.lists@gmail.com> Tue, 08 September 2009 15:59 UTC

DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:reply-to:date:message-id:subject:from:to:cc :content-type; b=v17FzBC7dl+oQjE+eqJv7jvwamdxmxu66vsuAbp4sCdAak3aByOBMCuOSc80LjdqDc I+8gSoapLQASaQ0DkPcKXbVUryvlVKyFzqUgvSXnxIXYkAUIx/udUM0jfscRcN0tT0fJ ERxrpZIb0x51KZQKcYOL9dK3RxqKEicA8G9Gc=
MIME-Version: 1.0
Date: Tue, 08 Sep 2009 12:00:17 -0400
Message-ID: <6c9fcc2a0909080900h7db8d58n21564c56e16bc543@mail.gmail.com>
From: Barry Leiba <barryleiba.mailing.lists@gmail.com>
To: secdir@ietf.org, iesg@ietf.org
Content-Type: text/plain; charset="ISO-8859-1"
Cc: draft-iana-ipv4-examples@tools.ietf.org
Subject: [secdir] secdir review of draft-iana-ipv4-examples-01
Precedence: list
Reply-To: barryleiba@computer.org

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

This is just a short, informational document that reserved two new
address ranges for example use.  I have no significant issues with it.

I do have two minor questions:

1. The document does have normative language, telling operators what
they SHOULD and SHOULD NOT do with this addresses, and it instructs
IANA not to allocate addresses from these blocks.  Should it be BCP,
rather than Informational?  It doesn't matter terribly, so I'm just
asking the question.

2. The Security Considerations section says the document has no
security implications, but I'm not sure that's correct.  By calling
out certain addresses as examples, we might be inviting malefactors to
try to snag traffic meant for these addresses in an attempt to trick
those who use the example addresses as though they were real.  If the
advice in the Operational Implications section isn't followed, that
would result in an opportunity for fraud, for example.  I look at this
as an explanation of the importance of following the Operational
Implications advice.

Again, I consider this a minor point, and the document should
certainly go forward.

Barry

[secdir] secdir review of draft-iana-ipv4-example… Barry Leiba