Subject: RE: Should IP Security be Optional?

From: [email-masked]
Date: Tue, 5 Mar 2002 09:10:51 +0200

Hi Mike,

> I think the v6 host requirements struck the right
> balance: require the IP packet layer transforms,
> and be silent on key distribution. Key
> distribution is clearly a huge problem, but IPsec
> doesn't mandate a single solution so I don't see
> why the cellular requirements draft should either.
> You can run IPsec with manually configured keys,
> after all, so at a base level you can get
> interoperability. This is foward progress IMO,
> even though we clearly need more going forward.

Thanks for the clarification.  I can see your point.
The authors definately need to review how we address
this in the document.

thanks,
John
--------------------------------------------------------------------
IETF IPng Working Group Mailing List
IPng Home Page:                      http://playground.sun.com/ipng
FTP archive:                      ftp://playground.sun.com/pub/ipng
Direct all administrative requests to [email-masked]
--------------------------------------------------------------------

---

From: "Bound, Jim" <[email-masked]>
Date: Wed, 6 Mar 2002 12:38:09 -0500

John,

If this is a "use" draft you can't say must anything without "use" in the sentence.

/jim

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Tuesday, March 05, 2002 2:30 AM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]; [email-masked];
> [email-masked]; [email-masked];
> [email-masked]
> Subject: RE: Should IP Security be Optional?
> 
> 
> Hi all,
> 
> > I do agree that the ESP and AH are really
> > simple and easy compared to the rest. Unfortunately,
> > this isn't going to be quite as easy as that. 
> > 
> > As we point out in section 3.8 the current
> > cellular networks sometimes have dynamic IP
> > address changes, and therefore manually keyed IPsec
> > isn't going to work as such and key management is
> > needed. While there might be multiple options
> > here, interoperability is a concern and hence
> > I feel that we must have a mandated key management
> > scheme. In the cellular host requirements draft, we
> > have chosen to say that IKE is a MUST in those
> > cases where we mandate IPsec. Do you disagree?
> > 
> > (In a way you could say that the cellular draft goes
> > *beyond* what the current IETF MUSTs are, given
> > that we mandate a full security solution in all cases,
> > though at the same time we don't mandate the current
> > requirement of AH and ESP in all cases.)
> > 
> > Anyway, this is just *our* proposal on what we think
> > would make sense. But the document is controlled by the
> > WG; please state your proposed security MUSTs for
> > IPv6 hosts, cellular or otherwise. Mike, what would you
> > like to have there, for instance?
> 
> Just to add onto Jari - it would be a no-brainer to
> state that IPsec (AH & ESP) MUST be supported,
> IKE MAY/SHOULD be supported.  However, does this 
> give users anything? Will it increase security for
> these devices, or is it just something that will make
> folks happy?  The authors prefer to have a reasonable
> discussion on security within the draft.  Knowledge of
> the field of Internet Security has increased since
> some of the initial IPv6 documents were published ...
> 
> thanks,
> John

---

From: "Januszewski, Joseph (CIT)" <[email-masked]>
Date: Thu, 7 Mar 2002 08:40:10 -0500

-----Original Message-----
From: Januszewski, Joseph (CIT) 
Sent: Tuesday, March 05, 2002 3:08 PM
To: 
Subject: FW: Should IP Security be Optional?

I think this has taken on a larger context than just cellular. (Which is I
guess why the Subject line has changed).

Don't forget that IPv4 is that it was designed in the early 70's, and people
were surrounded by IBM 360s and DEC PDP-11s, and a whole bunch of other
machines that no longer exist.  But, one of its strengths, although designed
in that environment, is that it allowed for growth through the Web phase of
the Internet.  Radiotelephones were the closest you got to mobile telephones
at that time, and today's wireless Email clients are starting to look like
something out of a Dick Tracy comic.  Beyond a short trip down memory lane
(or to the Smithsonian, depending on your age), I guess what I am suggesting
is that we would be limiting the applicability of IPv6 if we just thought in
terms of cellular media and wireless browsers.  In 1974, when the "@" sign
started to be used for "the new electronic mail application", how many
people were thinking "BlackBerry"? 

It has been said that no one intends on being around when IPv8 or IPv12 (or
what have you) has to be designed.  In that case, what needs to happen is a
larger, more generic framework needs to be designed that new technologies
can be merged into.  Also, that means that IP security should not be
optional.  Whether September 11th took place, or not, the world has been and
is full of all kinds of people - most nice, but some not nice.  For
commerce, communications and information transfer of all sorts to take
place, we need to think in these terms.  Cordless phones have scrambling
features, and police scanners that were the rage 20 years ago are mostly
obsolete because the authorities realized that everyone - including
criminals - could listen in on their operations.  The Internet is nearing
maturity, and should have these features built-in now, before it is totally
ubiquitous, and we have to continue to bolt-on security just like we've done
with IPv4, and every so-called modern operating system.

My $.02

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Monday, March 04, 2002 8:40 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Should IP Security be Optional?[Was
RE:draft-ietf-ipv6-cellu lar-host-00.txt -> wg last call?] 

> > > This seems to presume that you can predict in advance all of the
> > > applications that a user will wish to execute on a particular node.
Can you
> > > do that?
> > 
> > On a workstation you can't. On a tiny cellular device you
> > often can.

> only if the device doesn't have a data port.

Actually then (especially in 3GPP devices) the IP stack will actually also
be behind that dataport, i.e. in the laptop. That is then a different story.

-Jonne.

--------
Jonne Soininen
Nokia

Tel. +1 650 864 6794
Cellular: +1 650 714 7733
Email: [email-masked]

---

From: "JJTJ" <[email-masked]>
Date: Wed, 6 Mar 2002 22:04:34 -0500

My $.02

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Monday, March 04, 2002 8:40 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: Should IP Security be Optional?[Was

Can you

-Jonne.

--------
Jonne Soininen
Nokia

Tel. +1 650 864 6794