Subject: Re: Internet Draft for explicit security labels in IPv6.

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 01 Mar 2001 14:50:47 -0500

In message <[email-masked]>, "Joseph D. H
arwood" writes:
>This is a multi-part message in MIME format.
>
>------=_NextPart_000_0022_01C0A245.80C7E140
>Content-Type: text/plain;
>	charset="iso-8859-1"
>Content-Transfer-Encoding: 7bit
>
>My understanding of the draft was that, one of the goals is for intervening
>routers to be able to make routing decisions based on the contents of the
>security label (Section 3.4):
>
>   A router needs to trust the authenticity and integrity of a
>   packet before making routing decision based on the content of its
>   label.
>
>The proposal is to permit security labels in Hop-By-Hop Extension Headers,
>which (if I remember correctly) are only protected by AH.
>
>This would seem to require AH.

But intermediate routers don't have the keys to verify the AH header.

		--Steve Bellovin, http://www.research.att.com/~smb

--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Kais Belgaied <[email-masked]>
Date: Thu, 1 Mar 2001 10:57:59 -0800 (PST)

It mandates a guarantee that the label on the IPv6 is authentic before trusting
it. In a link-local scope, where the label is proposed to be carried in the
destination header, ESP is mandatory and sufficient.
On a wider scope, AH is necessary.

Kais.
>
>This sounds like it mandates the use of AH, is that correct?
>
>Best Regards,
>Joseph D. Harwood
>[email-masked]
>www.vesta-corp.com 
>
>> -----Original Message-----
>> From: [email-masked]
>> [mailto:[email-masked]]On Behalf Of Kais Belgaied
>> Sent: Wednesday, February 28, 2001 7:18 PM
>> To: [email-masked]; [email-masked]
>> Subject: Internet Draft for explicit security labels in IPv6.
>> 
>> 
>> Greetings,
>> 
>> IPv4 had IPSO and CIPSO for labeling of packets assuming we're operating
>> within the premises of a trusted infrastructure.
>> IPv6 only has the implicit labeling by having different IPsec SAs convey
>> different labels.
>> We think there is a need to have explicit labels in IPv6, whether or not
>> IPsec is used.
>> 
>> Please see draft-belgaied-ipv6-lsopt-00.txt
>> 
>> http://www.ietf.org/internet-drafts/draft-belgaied-ipv6-lsopt-00.txt
>>     
>>     
>> Regards,
>> Kais.
>> 
>> 
>>

---

From: Kais Belgaied <[email-masked]>
Date: Thu, 1 Mar 2001 13:37:37 -0800 (PST)

>Or it could be bound to the certificate and recreated at the far end.

It could, with the scalability limitation of implicit labeling.

Kais.

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Mon, 05 Mar 2001 21:27:41 -0500

>This would seem to require AH.

As I noted earlier, the intervening routers don't have the key to 
verify the AH protection.