Security review of Enhanced Duplicate Address Detection draft-ietf-6man-enhanced-dad-12 Do not be alarmed ... I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. Enhanced DAD (duplicate address detection) is intended to help network administrators with some debugging and measurement functions by allowing IPv6 routers to detect that the network has been configured for loopback testing. Without this new feature, routers would treat the recurring messages (the looped-back messages) as evidence of an address duplication. Currently, such an error should result in disabling the interface until manual commands are entered. The goal is to define a simple and reliable way for routers to detect that loopback is in effect. During the loopback testing, the detection of duplicate addresses will not result in disabling the interface. The proposed detection method, as mentioned in the Security Considerations, results in a new kind of attack, one in which duplicate addresses are allowed because an attacker can easily imitate or disable the loopback messages. The authors believe that SEND and SAVI protect against these attacks. If these are not already in place, an administrator must ask if the benefits of loopback are worth the increased risk of operating, at least temporarily, without DAD. If not, then is it worth the trouble of adding additional protections? The document intends to describe an algorithm and a state machine, but it does not have the terse language and diagrams that one would expect to accompany the prose descriptions. It does not explicitly describe what constitutes loopback detection. There is a grammo in the following crucial sentence: If there is a collision because two nodes using the same Target Address in their NS(DAD) and generated the same random nonce, then the algorithm will incorrectly detect a looped back NS(DAD) when a genuine address collision has occurred. I think that the sentence can be repaired by changing "using" to "used". With that, we implicitly get the definition of loopback detection: seeing two NS(DAD) messages with the same Target Address and the same Nonce. There is also a time window for the detection. The document refers to the normal (non-loopback) case of duplicate address detection as leading to the "DAD failed state". This term occurs almost nowhere else in the world. It may be the case that an interface in a failed state is not usually further qualified by the cause; maybe this draft should avoid the term. "Disabled because of DAD" perhaps? In section 5, I am confused by this statement: Any other network that follows the same trust model MAY use the automated actions proposed in this section. The problem is that as nearly as I can tell, there is only one such action in the section, the one in the immediately preceding sentence. It seems to me that the time interval for detection might be usefully replaced by a message count. This is because the probability of a nonce collision is the defining security metric, and that will depend on the size of the nonce space and the number of messages in the possible collision window. The minimum nonce size is 48 bits, a collision would be expected once in 16 million messages. I suppose that might happen on a very busy network with a small address space. Hilarie