[LAC-TF] Fwd: RFC 7739 on Security Implications of Predictable Fragment Identification Values

[Fernando Gont]

FYI: <https://www.rfc-editor.org/rfc/rfc7739.txt>

RFC #22 de Argentina.

Como con virtualmente el resto de mis otros RFCs
(<http://www.rfc-editor.org/search/rfc_search_detail.php?pubstatus[]=Any&author=Gont>),
éste requirió, por momentos, energias y discusiones a mi criterio
innecesarias.

El trabajo en cuestión fue realizado en un contexto en el que la
participación (activa) de la región en IETF cuenta con una cantidad de
problemas/limitantes de fondo (tanto propios de la region, como ajenos)
para los cuales no veo indicio alguno de que vayan a haber cambios o
soluciones. Estas cuestiones dificultan las tarea de quienes
participamos, y creo que des-incentivan la aparición de nuevas personas
de la región que contribuyan activamente en el poceso de estandarización
(mas allá de todos los titulares y frases bonitas sobre "inclusion" y
"diversidad" que uno escucha).


Mis agradecimientos a Iván Arce (Fundación Sadosky, de Argentina) por
ayudar a mejorar este trabajo, inclusive re-chequeando algunas cosas en
estas instancias finales.


Los Acks de este documento son:
---- cut here ----
   The author would like to thank Ivan Arce for proposing the attack
   scenario described in Appendix A.

   The author would like to thank Ivan Arce, Stephen Bensley, Ron
   Bonica, Tassos Chatzithomaoglou, Guillermo Gont, Brian Haberman, Bob
   Hinden, Sheng Jiang, Tatuya Jinmei, Merike Kaeo, Will Liu, Juan
   Antonio Matos, Simon Perreault, Hosnieh Rafiee, Meral Shirazipour,
   Mark Smith, Dave Thaler, and Klaas Wierenga, for providing valuable
   comments on earlier draft versions of this document.

   This document is based on work performed by Fernando Gont on behalf
   of the UK Centre for the Protection of National Infrastructure
   (CPNI).

   The author would like to thank Buffy for her love and support.
---- cut here ----

Saludos cordiales,
Fernando




-------- Forwarded Message --------
Subject: RFC 7739 on Security Implications of Predictable Fragment
Identification Values
Date: Tue,  2 Feb 2016 17:57:54 -0800 (PST)
From: rfc-editor at rfc-editor.org
To: ietf-announce at ietf.org, rfc-dist at rfc-editor.org
CC: drafts-update-ref at iana.org, ipv6 at ietf.org, rfc-editor at rfc-editor.org

A new Request for Comments is now available in online RFC libraries.


        RFC 7739

        Title:      Security Implications of Predictable Fragment
                    Identification Values
        Author:     F. Gont
        Status:     Informational
        Stream:     IETF
        Date:       February 2016
        Mailbox:    fgont at si6networks.com
        Pages:      20
        Characters: 46433
        Updates/Obsoletes/SeeAlso:   None

        I-D Tag:    draft-ietf-6man-predictable-fragment-id-10.txt

        URL:        https://www.rfc-editor.org/info/rfc7739

        DOI:        http://dx.doi.org/10.17487/RFC7739

IPv6 specifies the Fragment Header, which is employed for the
fragmentation and reassembly mechanisms.  The Fragment Header
contains an "Identification" field that, together with the IPv6
Source Address and the IPv6 Destination Address of a packet,
identifies fragments that correspond to the same original datagram,
such that they can be reassembled together by the receiving host.
The only requirement for setting the Identification field is that the
corresponding value must be different than that employed for any
other fragmented datagram sent recently with the same Source Address
and Destination Address.  Some implementations use a simple global
counter for setting the Identification field, thus leading to
predictable Identification values.  This document analyzes the
security implications of predictable Identification values, and
provides implementation guidance for setting the Identification field
of the Fragment Header, such that the aforementioned security
implications are mitigated.

This document is a product of the IPv6 Maintenance Working Group of the
IETF.


INFORMATIONAL: This memo provides information for the Internet community.
It does not specify an Internet standard of any kind. Distribution of
this memo is unlimited.

This announcement is sent to the IETF-Announce and rfc-dist lists.
To subscribe or unsubscribe, see
  https://www.ietf.org/mailman/listinfo/ietf-announce
  https://mailman.rfc-editor.org/mailman/listinfo/rfc-dist

For searching the RFC series, see https://www.rfc-editor.org/search
For downloading RFCs, see https://www.rfc-editor.org/rfc.html

Requests for special distribution should be addressed to either the
author of the RFC in question, or to rfc-editor at rfc-editor.org.  Unless
specifically noted otherwise on the RFC itself, all RFCs are for
unlimited distribution.


The RFC Editor Team
Association Management Solutions, LLC


--------------------------------------------------------------------
IETF IPv6 working group mailing list
ipv6 at ietf.org
Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------