Subject: Re: Label on the H-b-H (was Re: Internet Draft for explicit security labels in IPv6. )

From: Stephen Kent <[email-masked]>
Date: Fri, 2 Mar 2001 18:37:12 -0500

Kais,

>For a router to trust a label in the hop-by-hop header, it has to either
>*believe* the packet is authentic (packet coming in through an interface
>connected to a highly secured network), or it is the other end (dst) of an
>AH AS protecting the labeled packet.
>
>Here is an example:
>
>        Secure (trusted)   Unsecure network   Secure network
>           network         (non trustworthy)
>           /------\         //----\\         /------\
>           |      |         |      |         |      |
>Host1  --|      |-- SGW1--|      | --SGW2--|      |--- Host2
>           |      |         |      |         |      |
>           \------/         \\----//         \------/
>
>The security policy requires that data at certain labels follow certain paths
>inside the secure networks, and that it is offered a certain protection when
>travelling through untrusted clouds. The inside routers in the 
>trusted networks
>will use the label for trusted routing. Edge routers SGW1 & SGW2 
>MUST use an AH
>SA
>
>If confidentiality is required, An additional AH ESP between Host1 and Host2
>can be used.

I would expect SGW1 and SGW2 to establish an ESP tunnel between them, 
invoking integrity and authenticity for that tunnel (maybe 
confidentiality too) and that the security label would not be 
"visible" to the unsecure network. IPsec mandates that this SA be a 
tunnel, so the protection offered to the label by that SA, as I 
described above, is just right for your purpose.

Steve
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Kais Belgaied <[email-masked]>
Date: Thu, 1 Mar 2001 14:17:51 -0800 (PST)

Here is an example:

The security policy requires that data at certain labels follow certain paths
inside the secure networks, and that it is offered a certain protection when
travelling through untrusted clouds. The inside routers in the trusted networks
will use the label for trusted routing. Edge routers SGW1 & SGW2 MUST use an AH
SA

Kais.

>>
>>My understanding of the draft was that, one of the goals is for intervening
>>routers to be able to make routing decisions based on the contents of the
>>security label (Section 3.4):
>>
>>   A router needs to trust the authenticity and integrity of a
>>   packet before making routing decision based on the content of its
>>   label.
>>
>>The proposal is to permit security labels in Hop-By-Hop Extension Headers,
>>which (if I remember correctly) are only protected by AH.
>>
>>This would seem to require AH.
>
>But intermediate routers don't have the keys to verify the AH header.
>
>		--Steve Bellovin, http://www.research.att.com/~smb
>
>

---

From: "Joseph D. Harwood" <[email-masked]>
Date: Thu, 1 Mar 2001 14:33:50 -0800

Thank you, that clarifies the situation a great deal.

Since the packet must be tunneled between SG1 and SG2 (it's transit traffic,
Tunnel Mode is required), ESP could be used as well as AH and this would
also protect the security label of the inner packet.  Perhaps this option
could be included in the draft.

Best Regards,
Joseph D. Harwood
[email-masked]
www.vesta-corp.com

> -----Original Message-----
> From: Kais Belgaied [mailto:[email-masked]]
> Sent: Thursday, March 01, 2001 2:18 PM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: Label on the H-b-H (was Re: Internet Draft for explicit
> security labels in IPv6. )
>
>