Last Call Review of draft-iana-rfc3330bis-

Request Review of draft-iana-rfc3330bis
Requested rev. no specific revision (document currently at 11)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2009-04-07
Requested 2009-03-24
Authors Michelle Cotton, Leo Vegoda
Draft last updated 2009-04-02
Completed reviews Secdir Last Call review of -?? by Paul Hoffman
Secdir Telechat review of -?? by Paul Hoffman
Assignment Reviewer Paul Hoffman 
State Completed
Review review-iana-rfc3330bis-secdir-lc-hoffman-2009-04-02
Review completed: 2009-04-02


I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

This is essentially a security-free document. Having said that, the one paragraph in the Security Considerations section could use a bit of clarification. It says:

   The particular assigned values of special-use IPv4 addresses
   cataloged in this document do not directly raise security issues.
   However, the Internet does not inherently protect against abuse of
   these addresses; if you expect (for instance) that all packets from
   the block originate within your subnet, all border routers
   should filter such packets that originate from elsewhere.  Attacks
   have been mounted that depend on the unexpected use of some of these

I think that "all packets from the block" should be "all packets from a private address space such as the block or the link local block".

Also, I believe that "all border routers should filter such packets that originate from elsewhere" should be "all routers at the border of your network should filter such packets that originate from outside your network".

Please also note the messages on ietf-general from this past weekend; having another example block would help many IETF documents.

--Paul Hoffman, Director
--VPN Consortium