Subject: RE: Should IP Security be Optional? [Was RE: draft-ietf-ipv6-cellular-host-00.txt -> wg last call?]

From: "Bound, Jim" <[email-masked]>
Date: Wed, 6 Mar 2002 12:03:35 -0500

I agree security is important and IPsec is good.

But the market and vendors will ship and use what they want.  

And many will not use Ipsec in handsets for sure.

/jim

> -----Original Message-----
> From: Francis Dupont [mailto:[email-masked]]
> Sent: Monday, March 04, 2002 4:40 AM
> To: Margaret Wasserman
> Cc: Hesham Soliman (ERA); [email-masked]
> Subject: Re: Should IP Security be Optional? [Was RE:
> draft-ietf-ipv6-cellular-host-00.txt -> wg last call?] 
> 
> 
> I agree with you and Hesham: IPsec is required for any compliant
> IPv6 implementations and we should not accept an exemption for
> a device which can get a global address in the Internet.
> BTW the complexity argument is not very sound because IPsec
> with IKE is already available on PalmPilot and PSions (cf ipsec
> wg mailing list).
> Security should not be a compromise!
> 
> Thanks
> 
> [email-masked]
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
> 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Randy Bush <[email-masked]>
Date: Wed, 06 Mar 2002 10:35:43 -0800

> But the market and vendors will ship and use what they want.  

we are not a vendor.  we are the ietf.  we make the bestquality standards we
can.  if there are vendors which do not follow them, then if this is not due
to lack of quality of a standard, it is not our problem.  buyer beware.

randy

---

From: Jari Arkko <[email-masked]>
Date: Thu, 07 Mar 2002 11:33:53 +0200

> to lack of quality of a standard, it is not our problem.  buyer beware.

Randy and others,

I'd like to take a step back and recommend that people take a second look at
what we are trying to say about security in sections 3 and 5 of our draft. It
seems that people are interpreting the proposals as the intent of some
vendors to water down security. This really wasn't quite what we were trying
to do, so perhaps we've been unclear. If so, I'd like to clarify the situation
a bit. The main goals were:

1) Security is always mandatory (but not necessarily same type all the time)
2) Recommend the most suitable security for a particular function.
3) Figure out when particular security mechanisms work and when they
    don't. On a technical basis.

For instance, we are going *beyond* current IETF MUSTs in the saying that
in this particular environment (because of number of hosts and dynamic
IP addressing) you MUST implement IKE with IPsec and manual keying isn't
sufficient. On the other hand, we're also saying that IPsec isn't the
right security mechanism for all functions and isn't needed in all cases.
We are also saying -- perhaps contrary to the common belief in IETF --
that it isn't sufficient for protecting v6 local network control signaling
(ND etc) due to a number of reasons (an issue of which I have implementation
experience).

Having said the above, I think we have still gotten excellent feedback on the security
issue and have to work more on it, for instance on the effects of hosts that
can download new apps or applets. And as we've stated elsewhere already,
it's really the WG who gets to decide what eventually gets written to the
RFCs, and naturally what the mailing list feels goes to the next revision
of the document.

One possible way ahead would be Michael Thomas' suggestion on keeping
the current IETF MUST AH, ESP rules. This may well be the only acceptable
solution to everyone. However, I must point out that with just AH and ESP
you can't actually *use* them in an environment with e.g. dynamic
addressing and lots of nodes, so the rules are sort of half-way.

In conclusion, I'm hoping we could discuss some of the actual technical
issues, because it's a bit more fine grained than a security-nosecurity.

Jari