Subject: RE: [mobile-ip] MIPv6 - Focus of the security discussion

From: "Hesham Soliman (EPA)" <[email-masked]>
Date: Fri, 19 Oct 2001 00:34:07 +1000

> On Thu, 18 Oct 2001, Hesham Soliman (EPA) wrote:
> > 	- an "unpiggybacked" BU with a new ext header and 
> > 	- an SCTP payload.  
> > 	Could you tell me why these two are different ?
> > 
> > 	If you drop the former then you'd drop the latter ...right ?
> > 	Sounds like a firewall that needs an upgrade. 
> 
> The difference is significant.  Perhaps I can help to clarify the 
> situation.
> 
>  SCTP header would be like:
> 
>   IPv6 HDR - SCTP header
> 
>  BU with new Ext Header would be like (if I get this right):
> 
>   IPv6 HDR - UnknownHeaderBU - TCP/UDP/... header
> 
	=> No it's not like that. The _whole discussion was about 
	introducing a new ext header for IPsec and removing
	piggybacking. .... Please.... the 2 go hand in hand !

	Sigh 

	Hesham

---

From: Michael Thomas <[email-masked]>
Date: Thu, 18 Oct 2001 08:46:55 -0700 (PDT)

> 	piggybacking. .... Please.... the 2 go hand in hand !

                           ^
                           |
   s/ext/final-------------+

		Mike

---

From: Pekka Savola <[email-masked]>
Date: Thu, 18 Oct 2001 21:06:30 +0300 (EEST)

> 	piggybacking. .... Please.... the 2 go hand in hand !

Sorry, I didn't know what you meant, exactly, with:

'an "unpiggybacked" BU with a new ext header'

I took this as a BU dst option moved to a new, non-final extention header.  
If this would have been the case, my discussion would have applied.  
Perhaps you meant something else (a final BU ext header).

-- 
Pekka Savola                 "Tell me of difficulties surmounted,
Netcore Oy                   not those you stumble over and fall"
Systems. Networks. Security.  -- Robert Jordan: A Crown of Swords

---

From: "Jari Arkko" <[email-masked]>
Date: Thu, 18 Oct 2001 23:30:40 +0300

> Perhaps you meant something else (a final BU ext header).

I believe the discussion started from the possibility of defining a
new final BU extension header, in order to satisfy current IPsec
SPDs. I don't think we need to discuss the case of a new middle
extension header. For that, we already have a solution and it is
called Destination Options header.

Let me try to see if we could agree on a few conclusions here.
Yell if you don't agree:

* New middle headers could get messy. (But, as discussed
  above we do not need them either.)

* If a new payload header (= final extension header) would be
  used, then its introduction would create problems similar to
  the introduction of SCTP. There might be some firewalls (not
  sure if there are any yet for IPv6) that can only process fixed set
  of protocols. But the hope is that most products would have
  the possibility to enter protocol numbers etc.

* If a UDP port number were used instead, this would create
  no such problems.

* I detect slight preference here towards UDP port rather than
  a new header, if we decide to abandon the current DO approach.

* No conclusion yet on piggybacking being kept or not issue!

* And the same in the DO vs. separate BU issue.

Jari

---

From: Pekka Savola <[email-masked]>
Date: Thu, 18 Oct 2001 23:55:29 +0300 (EEST)

> * If a UDP port number were used instead, this would create

.. but at least low-range (privileged) ports might very often be filtered 
(looking back at IPv4).

There's not so much filtering yet for IPv6, though, so I think if we go
this route, this probably won't be a problem (consider with filtering
UDP/500).

So I don't think this would be an unsurmountable problem.
 
> * And the same in the DO vs. separate BU issue.

From my viewpoint, this seems rather good characterization (I can't really
tell of the piggybacking argument).