Re: RFC 3697bis Open issue 9

2011-02-03 Thread Steven Blake
On Thu, 3 Feb 2011 10:17:12 -0500, RJ Atkinson rja.li...@gmail.com wrote: In particular, a number of domains connected to the public Internet, including a number of commercial firms, are concerned about use of covert channels by their adversaries (e.g. to steal IPR, to probe interior network

Re: Psuedo-randomness in flow labels [was Re: [Fwd: I-D Action:draft-ietf-6man-flow-update-00.txt]]

2011-01-17 Thread Steven Blake
On Mon, 17 Jan 2011 12:55:53 -0700, Shane Amante sh...@castlepoint.net wrote: Thomas, On Jan 17, 2011, at 10:08 MST, Thomas Narten wrote: The point being, an attacker doesn't have to guess the actual Flow Labels that are being in use, but just come up with way to generate traffic that ECMP

Re: [Fwd: I-D Action:draft-ietf-6man-flow-update-00.txt]

2011-01-09 Thread Steven Blake
On Mon, 10 Jan 2011 14:45:05 +1300, Brian E Carpenter brian.e.carpen...@gmail.com wrote: Fred, I'm confused. We've been talking for months about recommending pseudo-random flow label values as inputs to hash functions, precisely to allow scaleable and stateless load balancing and ECMP. I

Re: [Fwd: I-D Action:draft-ietf-6man-flow-update-00.txt]

2010-12-14 Thread Steven Blake
On Wed, 15 Dec 2010 14:14:02 +1300, Brian E Carpenter brian.e.carpen...@gmail.com wrote: Hi, The authors have received one off-list comment on this version, requesting additional clarification of the text associated with this recommendation: 2. A network domain MUST NOT forward

Re: draft-krishnan-ipv6-exthdr, notes from Beijing

2010-11-17 Thread Steven Blake
On Wed, 2010-11-17 at 09:52 +0100, Hagen Paul Pfeifer wrote: On Tue, 16 Nov 2010 20:58:39 -0500, Steven Blake wrote: This does not address Ran's comment: why would we ever need a new extension header? Why aren't the Hop-by-Hop Options and Destination Options extension headers sufficient

Re: draft-krishnan-ipv6-exthdr, notes from Beijing

2010-11-16 Thread Steven Blake
On Wed, 17 Nov 2010 01:45:27 +0100, Hagen Paul Pfeifer ha...@jauu.net wrote: * Hing-Kam (Kam) Lam | 2010-11-17 05:23:47 [+0530]: The draft does not do that. I dont know which version you have been reading. You should read draft-ietf-6man-exthdr and draft-bhatia-6man-update-ipv6-ext-hdr to get

Re: I-D Action:draft-krishnan-6man-header-reserved-bits-00.txt

2010-10-29 Thread Steven Blake
On Fri, 29 Oct 2010 18:58:20 -0400, Suresh Krishnan suresh.krish...@ericsson.com wrote: Given all that, as Brian said, one class of potential applications that will not work well with a shorterflow label are the ones where longer is better. e.g. The flow label as nonce proposal. This is

Re: Flow label (im)mutability

2010-09-08 Thread Steven Blake
On Wed, 08 Sep 2010 13:18:41 +1200, Brian E Carpenter brian.e.carpen...@gmail.com wrote: Hi, The authors of draft-carpenter-6man-flow-update (now also including Shane Amante) are working on a new version. One fundamental issue that has come up is about the (lack of) security properties of

Re: Question on draft-gont-6man-flowlabel-security-00

2010-09-08 Thread Steven Blake
On Wed, 2010-09-08 at 11:22 -0600, Shane Amante wrote: Steve, On Sep 7, 2010, at 14:17 MDT, Steven Blake wrote: On Tue, 7 Sep 2010 13:58:21 -0600, Shane Amante sh...@castlepoint.net wrote: [snip] With that said, I don't think this algorithm is necessarily ideal. The FL value

Re: Question on draft-gont-6man-flowlabel-security-00

2010-09-07 Thread Steven Blake
On Tue, 7 Sep 2010 13:58:21 -0600, Shane Amante sh...@castlepoint.net wrote: Hi Fernando, I have a question on: http://tools.ietf.org/html/draft-gont-6man-flowlabel-security-00 Unless I misunderstand something, you're proposing that a flow-label be constructed using the IPv6 Source

RE: [Fwd: New Version Notification for draft-gont-6man-flowlabel-security-00]

2010-08-17 Thread Steven Blake
On Tue, 17 Aug 2010 09:06:23 -0500, George, Wes E [NTK] wesley.e.geo...@sprint.com wrote: draft-blake-ipv6-flow-label-nonce-02 is expired and I haven't heard much effort to push it forward again. IMO it would be more helpful to consider security implications and evaluate your solution with

Re: 0 FL mutable - Keep RFC 3697 but with improvements

2010-08-04 Thread Steven Blake
On Wed, 4 Aug 2010 12:23:05 +0200, Rémi Després remi.desp...@free.fr wrote: Hi Fred, Le 4 août 2010 à 10:13, Fred Baker a écrit : intellectually, end to end signaling might make sense. If so, it belongs in the end-to-end headers. +1 More importantly, who's using it? If using it end

Re: Stateless assignment of flow-labels in source hosts

2010-04-22 Thread Steven Blake
On Thu, 22 Apr 2010 10:08:34 +0200, Rémi Després remi.desp...@free.fr wrote: Le 21 avr. 2010 à 23:17, Brian E Carpenter a écrit : On 2010-04-21 20:50, Rémi Després wrote: Hi Brian, I wonder what you think of what I answered to James on another discussion thread. I agree. I think that

Re: Extracting the 5-tuple from IPv6 packets

2010-04-15 Thread Steven Blake
On Thu, 15 Apr 2010 11:22:09 -0400, Joel M. Halpern j...@joelhalpern.com wrote: The one obvious conclusion here is that if we want hosts to actually set flow labels, then we are largely preempting network modification of those flow labels. Whatever setting we want to allow, it would have to

Re: Flow Label consistency question

2005-04-25 Thread Steven Blake
On Mon, 2005-04-25 at 18:23 +0300, Ran Liebermann wrote: The only reason for the value of be kept e2e is if this value should signal something to routers in the path of the flow (the reason why not including the value in upper layers) and still be used by the destination for something (for

Re: IPv6 WG Last Call:draft-ietf-ipv6-unique-local-addr-02.txt

2004-02-09 Thread Steven Blake
On Mon, 2004-02-09 at 12:22, Tim Chown wrote: On Mon, Feb 09, 2004 at 09:16:49AM -0800, Alain Durand wrote: Billing recurrent fees is a way to guaranty that the database will be maintainable. With 1,000 billion entries, it might also become a large database... That's why proof of