Re: drafty IPv6 security overview draft submitted

[Alain Durand <Alain.Durand@Sun.COM>]

Pekka,

Thanks for starting this effort.
A couple points:
1- You do not talk about the tunneling/open relay issues,
     like the abuse of 6to4. those were discussed elsewhere,
     but I think it would be worth it mentionning them here.

2- I came across an interesinting issue when playing with VPN:
    I use an IPv4 VPN to connect to my office network.
    My DNS resolution is done over IPv4.
    When I'm looking for my server, the DNS (over IPv4 over VPN)
    returns both A and AAAA records. When my laptop is on an IPv6
    enable link, it will use IPv6 to try to connec to my server.
    However, the VPN does not know about IPv6, and it let the packets
    go on the local network. Anybody on the
    local link can intercept those packets by pretending to have the IPv6
    address of my server (thanks to neighbor discovery, it does not even
    have to compromise any router...).
    This may be a bug in my VPN, bit I wonder how many VPNs share
    the same behavior...

   - Alain.



Pekka Savola wrote:

> Hello all,
>
> I just submitted a draft on IPv6 security overview.  It's quite raw 
> and badly structured, but I ran out of time (and I'm off for a few 
> days, back on Wednesday or so).
>
> I've tried to describe at least briefly all the aspects relating to IPv6 
> and IPv6 transition/co-existence I could quickly think of.  This could be 
> one basis for the security discussion in Vienna.
>
> Please have a look at it at some point and send feedback.
>
> Prior to it being formally posted, it can be read from:
>
> http://www.netcore.fi/pekkas/ietf/draft-savola-v6ops-security-overview-00.txt
>
> Abstract
>
>   The transition/co-existance from IPv4 to IPv4/IPv6 causes one to
>   consider the security considerations of such a process.  In this
>   memo, I try to give an overview of different aspects relating to
>   IPv6: the notion of increased end-to-end transparency, implications
>   of tunneling, the use of IPv4-mapped addresses, the considerations of
>   IPv6 service piloting without firewalls, IPv6 protocol-specific
>   issues, IPv6 transition/co-existence mechanism -specific issues,
>   consequences of enabling IPv6 by default, and operational security
>   issues when enabling IPv6 in the network infrastructure.
>
>
> It's only about 8 pages or so :-)
>
>