Subject: RE: Should IP Security be Optional? [Was RE: draft-ietf-ipv6-cellular-host-00.txt -> wg last call?]

From: "Bound, Jim" <[email-masked]>
Date: Wed, 6 Mar 2002 12:21:08 -0500

It will take us years to secure all that we have to.  IPsec has been
mandated since 1996 at least.  Yet is was the last IPv6 spec in products
and I think compaq and ibm are the only vendors with product ipsec for
ipv6.

/jim

> -----Original Message-----
> From: Francis Dupont [mailto:[email-masked]]
> Sent: Monday, March 04, 2002 6:14 AM
> To: Jari Arkko
> Cc: Margaret Wasserman; Hesham Soliman (ERA); [email-masked]
> Subject: Re: Should IP Security be Optional? [Was RE:
> draft-ietf-ipv6-cellular-host-00.txt -> wg last call?] 
> 
> 
>  In your previous mail you wrote:
> 
>    But we should avoid adding other mechanisms that we do not need.
> 
> => we need IPsec and we need even other mechanisms because IPsec
> is not all the security. For instance for mails between humans
> we need PGP or S/MIME too.
>    
>    > Security should not be a compromise!
>    
>    Please note that I do NOT want to say that we shouldn't
>    use IPsec. Rather, you could say that I'd like to get
>    a more appropriate applicability statement for it than
>    we currently have.
> 
> => there is an IAB statement about security. IPsec support was
> made mandatory according to this statement and IMHO this was
> a big step forward. There are other security mechanisms,
> including some at the transport layer (SSL/TLS, IMHO IPsec
> is better but real world considerations have to be considered :-)
> and some at the application layer, with in some cases a very
> different usage (PGP).
> I have in favor of to make all core security mechanisms mandatory
> (MUST or strong SHOULD), cf RFC 2316 section 10. IPsec is only
> the first in the list.
> 
>    For instance, the recommendations we have
>    in some base IPv6 RFCs on the use of IPsec for ICMP protection
>    are at least misleading -- and this is from personal
>    experience on actually trying to do that. Have you tried
>    it?
>    
> => yes, ICMP is hard to protect and to use it for small services
> does not make things simpler...
> 
> Regards
> 
> [email-masked]
> --------------------------------------------------------------------
> IETF IPng Working Group Mailing List
> IPng Home Page:                      http://playground.sun.com/ipng
> FTP archive:                      ftp://playground.sun.com/pub/ipng
> Direct all administrative requests to [email-masked]
> --------------------------------------------------------------------
> 
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: Ignatios Souvatzis <[email-masked]>
Date: Thu, 7 Mar 2002 11:56:35 +0100

> and I think compaq and ibm are the only vendors with product ipsec for

- Plus Solaris8, at least according to the man... ah, _for ipv6_? This I don't
know.

- Plus people intrating KAME based stacks.

Regards,
	-is