base.txt		issue33b.txt
Skipping to change at page 24, line 15:
6. Authorization Delegation Discovery		6. Authorization Delegation Discovery
Several protocols, including the IPv6 Neighbor Discovery Protocol,		Several protocols, including the IPv6 Neighbor Discovery Protocol,
allow a node to automatically configure itself based on information		allow a node to automatically configure itself based on information
it learns shortly after connecting to a new link. It is particularly		it learns shortly after connecting to a new link. It is particularly
easy to configure "rogue" routers on an unsecured link, and it is		easy to configure "rogue" routers on an unsecured link, and it is
particularly difficult for a node to distinguish between valid and		particularly difficult for a node to distinguish between valid and
invalid sources of information, when the node needs this information		invalid sources of information, when the node needs this information
before being able to communicate with nodes outside of the link.		before being able to communicate with nodes outside of the link.
Since the newly-connected node cannot communicate off-link, it can		Since the newly-connected node cannot communicate off-link, it cannot
not be responsible for searching information to help validating the		be responsible for searching information to help validating the
router(s); however, given a chain of appropriately signed		router(s); however, given a chain of appropriately signed
certificates, it can check someone else's search results and conclude		certificates, it can check someone else's search results and conclude
that a particular message comes from an authorized source. In the		that a particular message comes from an authorized source. In the
typical case, a router, which is already connected to beyond the		typical case, a router, which is already connected to beyond the
link, can (if necessary) communicate with off-link nodes and		link, can (if necessary) communicate with off-link nodes and
construct such a certificate chain.		construct such a certificate chain.
The Secure Neighbor Discovery Protocol mandates a certificate format		The Secure Neighbor Discovery Protocol mandates a certificate format
and introduces two new ICMPv6 messages that are used between hosts		and introduces two new ICMPv6 messages that are used between hosts
and routers to allow the host to learn a certificate chain with the		and routers to allow the host to learn a certificate chain with the
Skipping to change at page 46, line 24:
communications.		communications.
There may be no cryptographic binding in SEND between the link layer		There may be no cryptographic binding in SEND between the link layer
frame address and the IPv6 address. On an insecure link layer that		frame address and the IPv6 address. On an insecure link layer that
allows nodes to spoof the link layer address of other nodes, an		allows nodes to spoof the link layer address of other nodes, an
attacker could disrupt IP service by sending out a Neighbor		attacker could disrupt IP service by sending out a Neighbor
Advertisement having the source address on the link layer frame of a		Advertisement having the source address on the link layer frame of a
victim, a valid CGA address and a valid signature corresponding to		victim, a valid CGA address and a valid signature corresponding to
itself, and a Target Link-layer Address extension corresponding to		itself, and a Target Link-layer Address extension corresponding to
the victim. The attacker could then proceed to cause a traffic		the victim. The attacker could then proceed to cause a traffic
stream to bombard the victim in a DoS attack. To protect against		stream to bombard the victim in a DoS attack. This attack cannot be
such attacks, link layer security SHOULD be used.		prevented just by securing the link layer alone.
Even on a secure link layer, SEND does not require that the addresses		Even on a secure link layer, SEND does not require that the addresses
on the link layer and Neighbor Advertisements correspond to each		on the link layer and Neighbor Advertisements correspond to each
other. However, it is RECOMMENDED that such checks be performed		other. However, it is RECOMMENDED that such checks be performed
where this is possible on the given link layer technology.		where this is possible on the given link layer technology.
Prior to participating in Neighbor Discovery and Duplicate Address		Prior to participating in Neighbor Discovery and Duplicate Address
Detection, nodes must subscribe to the link-scoped All-Nodes		Detection, nodes must subscribe to the link-scoped All-Nodes
Multicast Group and the Solicited-Node Multicast Group for the		Multicast Group and the Solicited-Node Multicast Group for the
address that they are claiming for their addresses; RFC 2461 [7].		address that they are claiming for their addresses; RFC 2461 [7].
End of changes.
This html diff was produced by rfcdiff v0.42, available from http://www.levkowetz.com/ietf/tools/rfcdiff/