Subject: RE: Proposal for site-local clean-up

From: "Christian Huitema" <[email-masked]>
Date: Wed, 20 Nov 2002 19:15:23 -0800

> Perhaps more importantly, I don't buy the argument that *any* set of
> addresses should be considered trustworthy, by default or otherwise.  
> Addresses are simply not sufficient as an authentication mechanism. 
> This is not a practice that IETF standards should endorse or encourage.

I certainly agree with your first point: considering a block of addresses trustworthy is silly. What site locals give you is a component of "defense in depth": if an application listen only to a local scope addresses, it will not receive any packet that come directly from the Internet. Like it or not, that is a sizeable risk reduction, even if it is indeed possible to receive packets from a compromised local host, or from a clandestine attachment to the local network. But clearly, that is not sufficient: applications shall indeed check the credentials of their remote users, not just the addresses.

-- Christian Huitema

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Erik Nordmark <[email-masked]>
Date: Thu, 21 Nov 2002 14:41:42 +0100 (CET)

> I certainly agree with your first point: considering a block of addresses
> trustworthy is silly. What site locals give you is a component of "defense
> in depth": if an application listen only to a local scope addresses, it will
> not receive any packet that come directly from the Internet. Like it or not,
> that is a sizeable risk reduction, even if it is indeed possible to receive
> packets from a compromised local host, or from a clandestine attachment to
> the local network. But clearly, that is not sufficient: applications shall
> indeed check the credentials of their remote users, not just the addresses.

The actual benefit of this is a function of what messages folks deliver to
users and application writers.

If folks say that site-locals provide a security benefit the users
and app writers might be less careful, potentially removing any benefit.

Thus I would argue that one should get users and programmers to *think*
about site-locals as globals from a security perspective.
I think that would be hard.

  Erik

---

From: Keith Moore <[email-masked]>
Date: Thu, 21 Nov 2002 09:10:36 -0500

> trustworthy is silly. What site locals give you is a component of "defense in
> depth": if an application listen only to a local scope addresses, it will not
> receive any packet that come directly from the Internet. Like it or not, that
> is a sizeable risk reduction, even if it is indeed possible to receive packets
> from a compromised local host, or from a clandestine attachment to the local
> network. 

you have not demonstrated that this is a sizable risk reduction.  
another problem with this argument is that it doesn't consider the
increase in risk that comes with using site locals, due to the
impaired ability to detect external traffic.  essentially if you
are trusting site locals then you are trusting the filters on the
border router with no way to verify whether they are working.

> But clearly, that is not sufficient: applications shall indeed check
> the credentials of their remote users, not just the addresses.

applications need to check the credentials of *all* users.  trusting
any address is a security hole.  it prevents the very "defense in depth"
you are claiming is an advantage of site locals.

Keith