SECDIR review of draft-ietf-v6ops-addr-select-req-02.txt

[Julien Laganier <julien.IETF@laposte.net>]

I have reviewed this document as part of the security 
directorate's ongoing effort to review all IETF 
documents being processed by the IESG.  These comments 
were written primarily for the benefit of the security 
area directors.  Document editors and WG chairs should 
treat these comments just like any other last call 
comments.

Background: In multi-prefix environments it is possible 
for an IPv6 node to have multiple IPv6 addresses 
available. There is thus a need to select appropriate 
source and destination addresses when initiating 
communication. RFC3484 defines default address 
selection for IPv6. Another v6ops draft 
[I-D.ietf-v6ops-addr-select-ps] points to some 
situations in which RFC3484 leads to problems, hence 
the desire to introduce new selection mechanisms 
overcoming those. This document discusses requirements 
for such mechanisms. 

Security Review: While I think this is useful work, I 
am concerned that security wasn't made a requirement 
in itself and is instead just touched upon in the 
security considerations section. I also think that the 
security considerations section is not appropriate: it 
doesn't do a good job of analyzing threats that might 
be introduced by address selection mechanisms. It is 
insufficient to state that "incorrect address 
selection can lead to serious security problems, such 
as session hijack", this is too vague. Security 
threats should be listed exhaustively. As I already 
said, I believe that it should be made a requirement 
in itself that these threats are appropriately 
countered. Since it also seems that address selection 
mechanisms can be realized via protocols, it might 
also be good to go into what are the requirements on 
protection of these protocols (e.g. network filtering 
at the domain boundary, message authentication, etc.).

Non-security nit: In section 2.5., "address selection 
API" could reference a recently approved individual 
submission [I-D.chakrabarti-ipv6-addrselect-api]. 

Hope that helps. Best regards,

--julien