Subject: Re: Internet Draft for explicit security labels in IPv6.

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 01 Mar 2001 14:27:24 -0500

In message <[email-masked]>, Kais Belgaied writes:
>It mandates a guarantee that the label on the IPv6 is authentic before trustin
>g
>it. In a link-local scope, where the label is proposed to be carried in the
>destination header, ESP is mandatory and sufficient.
>On a wider scope, AH is necessary.

Or it could be bound to the certificate and recreated at the far end.
>
>Kais.
> >
> >This sounds like it mandates the use of AH, is that correct?
> >
> >Best Regards,
> >Joseph D. Harwood
> >[email-masked]
> >www.vesta-corp.com 
> >
> >> -----Original Message-----
> >> From: [email-masked]
> >> [mailto:[email-masked]]On Behalf Of Kais Belgaied
> >> Sent: Wednesday, February 28, 2001 7:18 PM
> >> To: [email-masked]; [email-masked]
> >> Subject: Internet Draft for explicit security labels in IPv6.
> >> 
> >> 
> >> Greetings,
> >> 
> >> IPv4 had IPSO and CIPSO for labeling of packets assuming we're operating
> >> within the premises of a trusted infrastructure.
> >> IPv6 only has the implicit labeling by having different IPsec SAs convey
> >> different labels.
> >> We think there is a need to have explicit labels in IPv6, whether or not
> >> IPsec is used.
> >> 
> >> Please see draft-belgaied-ipv6-lsopt-00.txt
> >> 
> >> http://www.ietf.org/internet-drafts/draft-belgaied-ipv6-lsopt-00.txt
> >>     
> >>     
> >> Regards,
> >> Kais.
> >> 
> >> 
> >> 
>
>
>

		--Steve Bellovin, http://www.research.att.com/~smb

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Joseph D. Harwood" <[email-masked]>
Date: Thu, 1 Mar 2001 11:48:16 -0800

My understanding of the draft was that, one of the goals is for intervening
routers to be able to make routing decisions based on the contents of the
security label (Section 3.4):

   A router needs to trust the authenticity and integrity of a
   packet before making routing decision based on the content of its
   label.

The proposal is to permit security labels in Hop-By-Hop Extension Headers,
which (if I remember correctly) are only protected by AH.

This would seem to require AH.

Best Regards,
Joseph D. Harwood
[email-masked]
www.vesta-corp.com

> From: [email-masked] [mailto:[email-masked]]
> Sent: Thursday, March 01, 2001 11:27 AM
> To: Kais Belgaied
> Cc: [email-masked]; [email-masked];
> [email-masked]
> Subject: Re: Internet Draft for explicit security labels in IPv6.
>
>