| Hello Brian, Thanks for your review! We've just posted a new version of the draft that includes an extra section in the security considerations. https://tools.ietf.org/html/draft-ietf-v6ops-rfc6555bis-06 https://www.ietf.org/rfcdiff?url2=draft-ietf-v6ops-rfc6555bis-06 The references in RFC 6555 to Same-Origin Policy point to RFC 6454. That document actually only references that the policy gates schemes, hosts, and ports—not IP addresses directly. Relying on consistent IP address results from hostname resolution as a security property would be a problem that arises any time a new DNS query is made, so we believe that Happy Eyeballs does not actually expose any new concern here. Using TLS to validate the identity of a server, along with validation of the same host, port, and scheme, should avoid any concern with using different DNS results. The comment I've added to the security considerations indicates that implementations should not assume that addresses will be consistent for a hostname as a security property, and that Happy Eyeballs may make it more likely in some scenarios that an address will change between connection attempts. Thanks, Tommy
|