https://insinuator.net/tags/dnssec/ Recent content in DNSSEC on Insinuator.net - Bold Statements Hugo en-us Tue, 03 Nov 2015 00:00:00 +0000 https://insinuator.net/2015/11/some-notes-on-the-drop-ipv6-fragments-vs.-this-will-break-dnssec-debate/ Tue, 03 Nov 2015 00:00:00 +0000 https://insinuator.net/2015/11/some-notes-on-the-drop-ipv6-fragments-vs.-this-will-break-dnssec-debate/ <p>Some readers will probably be aware that we are amongst the proponents of a quite strict stance when it comes to filtering IPv6 packets with (certain) Extension Headers and/or fragmentation, because those can be the source of many security problems (as laid out <a href="https://www.ernw.de/download/eu-14-Atlasis-Rey-Schaefer-briefings-Evasion-of-HighEnd-IPS-Devices-wp.pdf">here</a>, <a href="http://gsec.hitb.org/materials/sg2015/D3%20-%20Marc%20Heuse%20-%20Hiding%20in%20Complexity.pdf">here</a> or <a href="https://www.insinuator.net/2015/01/evasion-of-cisco-acls-by-abusing-ipv6-discussion-of-mitigation-techniques/">here</a>). Actually I still think it was a very good idea of, amongst others, Randy Bush and Ron Bonica to <a href="https://tools.ietf.org/id/draft-bonica-6man-frag-deprecate-02.txt">suggest the deprecation of IPv6 fragmentation in the IETF</a>.<br> On the other hand there are voices arguing that fragmented IPv6 packets will be needed in some cases, namely DNS[SEC]-related ones.<br> In this post I will discuss some details of this debate (taking place in many circles, incl. <a href="http://lists.si6networks.com/pipermail/ipv6hackers/2015-October/thread.html">this thread</a> on the <em>ipv6-hackers</em> mailing list which, btw, <a href="http://lists.si6networks.com/listinfo/ipv6hackers/">you should subscribe to</a>).</p>