Subject: [Int-area] draft-george-ipv6-required-01.txt --- what about IPsec ?

From: Tim Shepard <[email-masked]>
Date: Tue, 29 Mar 2011 08:59:18 -0400

The Security Considerations section in draft-george-ipv6-required-01
says:

  5.  Security Considerations
  
     There are no direct security considerations generated by this
     document, but existing documented security considerations for
     implementing IPv6 will apply.

At a minimum, your Security Considerations should contain a pointer to
where those existing security considerations for implementing IPv6 are
fully documented.

Reading the above Security Considerations section reminded me that I
once heard a rumor that IPsec is required in IPv6.

It would be nice to know if that rumor is (still) true.  

I spent about 10 minutes before the int-area meeting started trying to
figure out what I should read to know if IPsec is required in IPv6.  I
didn't find anything that was completely clear about that.

The Security Considerations section of RFC 2460 says just this one
sentence: "The security features of IPv6 are described in the
Security Architecture for the Internet Protocol [RFC-2401]."  That
seems to be less than the full story.

RFC 2401 is obsoleted by RFC 4301. RFC 2401 and RFC 4301 both contain
this identical sentence: "This section defines Security Association
management requirements for all IPv6 implementations and for those
IPv4 implementations that implement AH, ESP, or both AH and ESP."
This seems to imply IPsec is required in all implementations of IPv6.

But I observe there is almost no use of IPsec today, on IPv4 or IPv6,
other than for VPN tunnels.   I've seen plenty of use of IPv6, but
don't believe I've ever seen IPsec over IPv6.

I fear "IPsec required for IPv6" would slow deployment of IPv6.  More
widespread implementation of IPv6 even if IPsec is not included would
be a good thing.

			-Tim Shepard
			 [email-masked]

---

From: Francis Dupont <[email-masked]>
Date: Tue, 29 Mar 2011 15:42:24 +0200

In your previous mail you wrote:

   I fear "IPsec required for IPv6" would slow deployment of IPv6.

=> IMHO it doesn't matter as the IETF has *no* way to enforce
such a thing: you can require IPv6 boxes to be blue with red points,
it will have the same effect (other to show it is ridiculous :-).
BTW this was fixed in the requirements for IPv6 nodes and similar
documents.

Regards

[email-masked]

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 30 Mar 2011 03:06:39 +1300

>    I fear "IPsec required for IPv6" would slow deployment of IPv6.

We have never attempted to mandate *deployment* of IPsec.

> BTW this was fixed in the requirements for IPv6 nodes and similar

Indeed. See draft-ietf-6man-node-req-bis, and ignore section 8 of
RFC 4294 (which is not a standard anyway).

There may be Government profiles that haven't caught up yet, not to
mention confusing propaganda from the IPv6 Forum.

    Brian

---

From: Joel Jaeggli <[email-masked]>
Date: Tue, 29 Mar 2011 07:11:41 -0700

>    I fear "IPsec required for IPv6" would slow deployment of IPv6.

Simply put it's been ignored so far whenever it's convenient which
appears to be frequently. I don't see that changing and our document
series (to Francis's point) appears to be updating in favor of reality.

> _______________________________________________
> Int-area mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/int-area
>

---

From: Julien Laganier <[email-masked]>
Date: Tue, 29 Mar 2011 07:15:31 -0700

Tim,

The last rev of the IPv6 node requirements document states that IPsec
is no longer required but only recommended for IPv6:

>From http://tools.ietf.org/html/draft-ietf-6man-node-req-bis-08

   Previously, IPv6 mandated implementation of IPsec and recommended the
   key management approach of IKE.  This document updates that
   recommendation by making support of the IP Security Architecture [RFC
   4301] a SHOULD for all IPv6 nodes.

--julien

---

From: "George, Wes E [NTK]" <[email-masked]>
Date: Tue, 29 Mar 2011 15:44:00 +0000

Tim - 
Thanks for putting your concern out on the list.
If after reviewing http://tools.ietf.org/html/draft-ietf-6man-node-req-bis-08
you are not happy with the security references, then as I said at the mic, this
is something better addressed in either v6ops or 6man, since they own the
implementation/maintenance of the protocol. This draft is not the correct
location to fix any perceived lack of clarity around IPv6 security
considerations, because it is not implementing anything new.
That said, the draft is certainly open to other suggested references to address
your concern, including additional text within the security considerations
section that reference useful info in other drafts/standards. If there are
additional informative references beyond what is currently found in the draft (
http://tools.ietf.org/html/draft-george-ipv6-required-01#page-6 ) I'm glad to
have them.

Thanks, 
Wes George 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Tim Shepard
Sent: Tuesday, March 29, 2011 8:59 AM
To: [email-masked]
Subject: [Int-area] draft-george-ipv6-required-01.txt --- what about IPsec ?

  

At a minimum, your Security Considerations should contain a pointer to where
those existing security considerations for implementing IPv6 are fully
documented.

Reading the above Security Considerations section reminded me that I once heard
a rumor that IPsec is required in IPv6.

I spent about 10 minutes before the int-area meeting started trying to figure
out what I should read to know if IPsec is required in IPv6.  I didn't find
anything that was completely clear about that.

The Security Considerations section of RFC 2460 says just this one
sentence: "The security features of IPv6 are described in the Security
Architecture for the Internet Protocol [RFC-2401]."  That seems to be less than
the full story.

RFC 2401 is obsoleted by RFC 4301. RFC 2401 and RFC 4301 both contain this
identical sentence: "This section defines Security Association management
requirements for all IPv6 implementations and for those
IPv4 implementations that implement AH, ESP, or both AH and ESP."
This seems to imply IPsec is required in all implementations of IPv6.

I fear "IPsec required for IPv6" would slow deployment of IPv6.  More widespread
implementation of IPv6 even if IPsec is not included would be a good thing.

			-Tim Shepard
			 [email-masked]

---

From: Tim Shepard <[email-masked]>
Date: Tue, 29 Mar 2011 12:49:33 -0400

George,

OK, I have now read the relevant parts of
draft-ietf-6man-node-req-bis-08 and it says what needs to be said,
quite well actually.

I do think an explicit pointer to that within the Security
Considerations section of your draft would be good.

Since the int-area meeting today I've had about 10 conversations
about this and one person told me that IPsec is no longer required
in IPv6.  Another person told me it depends on which document you
read.  Everyone else told me that IPv6 requires IPsec (though a few
told me that they expect this requirement will be ignored by most
everyone).

What I believe is true currently is that IPsec is still required,
but that if/when the current security-related text in
draft-ietf-6man-node-req-bis-08 gets published in a standards track
RFC (and we do expect this will happen eventually), then IPsec will
no longer be required in an IPv6 implementation (a SHOULD instead of
a MUST).

And we should spread this news to enlighten the ignorant (like me
earlier today).

			-Tim Shepard
			 [email-masked]