scope:

Introduction

Teredo [RFC4380] defines a set of flags that are embedded in every Teredo IPv6 address. This document specifies a set of security updates that modify the use of this flags field, but are backwards compatible. This document updates RFC 4380.

The Flags field in a Teredo IPv6 address has 13 unused bits out of a total of 16 bits. To guard against address-scanning risks [RFC5157] from malicious users, this update randomizes 12 of the 13 unused bits when configuring the Teredo IPv6 address. Even if an attacker were able to determine the external (mapped) IPv4 address and port assigned by a NAT to the Teredo client, the attacker would still need to attack a range of 4,096 IPv6 addresses to determine the actual Teredo IPv6 address of the client.

The cone bit in a Teredo IPv6 address indicates whether a peer needs to send Teredo control messages before communicating with a Teredo IPv6 address. Unfortunately, it may also have some value in terms of profiling to the extent that it reveals the security posture of the network. If the cone bit is set, an attacker may decide it is fruitful to port-scan the embedded external IPv4 address and others associated with the same organization, looking for open ports. Deprecating the cone bit prevents the a priori revelation of the security posture of the NAT.