Subject: Node Requirements: Updated IPsec/IKEv2 text

From: Thomas Narten <[email-masked]>
Date: Wed, 25 Aug 2010 09:16:43 -0400

To recap, I presented on the issue of updating the IPsec/IKEv2  text
at the 6man meeting in Maastricht, as well as at the SAAG meeting. My
sense of both of those discussions is that there is support for
changing the general recommendation to a SHOULD.

I got some good feedback in SAAG about the wording (refer to the
security architecture generally rather than IKEv2, etc.).

New proposed text below.

Comments?

Thomas

10.  Security

   This section describes the specification for security for IPv6 nodes.

   Achieving security in practice is a complex undertaking.  Operational
   procedures, protocols, key distribution mechanisms, certificate
   management approaches, etc. are all components that impact the level
   of security actually achieved in practice.  More importantly,
   deficiencies or a poor fit in any one individual component can
   significantly reduce the overall effectiveness of a particular
   security approach.

   IPsec provides channel security at the Internet layer, making it
   possible to provide secure communication for all (or a subset of)
   communication flows at the IP layer between pairs of internet nodes.
   IPsec provides sufficient flexibility and granularity that individual
   TCP connections can (selectively) be protected, etc.

   Although IPsec can be used with manual keying in some cases, such
   usage has limited applicability and is not recommended.

   A range of security technologies and approaches proliferate today
   (e.g., IPsec, TLS, SSH, etc.)  No one approach has emerged as an
   ideal technology for all needs and environments.  Moreover, IPsec is
   not viewed as the ideal security technology in all cases and is
   unlikely to displace the others.

   Previously, IPv6 mandated implementation of IPsec and recommended the
   key management approach of IKE.  This document updates that
   recommendation by making support of the IP Security Architecture [RFC
   4301] a SHOULD for all IPv6 nodes.  Note that the IPsec Architecture
   requires (e.g., Sec. 4.5 of RFC 4301) the implementation of both
   manual and automatic key management.  Currently the default automated
   key management protocol to implement is IKEv2.

   This document recognizes that there exists a range of device types
   and environments where other approaches to security than IPsec can be
   justified.  For example, special-purpose devices may support only a
   very limited number or type of applications and an application-
   specific security approach may be sufficient for limited management
   or configuration capabilities.  Alternatively, some devices my run on
   extremely constrained hardware (e.g., sensors) where the full IP
   Security Architecture is not justified.

10.1.  Requirements

   "Security Architecture for the Internet Protocol" [RFC4301] SHOULD be
   supported by all IPv6 nodes.  Note that the IPsec Architecture
   requires (e.g., Sec. 4.5 of RFC 4301) the implementation of both
   manual and automatic key management.  Currently the default automated
   key management protocol to implement is IKEv2.

10.2.  Transforms and Algorithms

   The current set of mandatory-to-implement algorithms for the IP
   Security Architcture are defined in 'Cryptographic Algorithm
   Implementation Requirements For ESP and AH' [RFC4835].  IPv6 nodes
   implementing the IP Security Architecture MUST conform to the
   requirements in [RFC4835].  Preferred cryptographic algorithms often
   change more frequently than security protocols.  Therefore
   implementations MUST allow for migration into new algorithms, as
   RFC4835 is replaced or updated in the future.

---

From: Fernando Gont <[email-masked]>
Date: Wed, 25 Aug 2010 10:30:28 -0300

Hi, Thomas,

The text looks good to me.

>    RFC4835 is replaced or updated in the future.

Shouldn't it be "migration to" rather than "migration into"?

Thanks,
-- 
Fernando Gont
e-mail: [email-masked] || [email-masked]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1

---

From: "Frankel, Sheila E." <[email-masked]>
Date: Wed, 25 Aug 2010 10:19:02 -0400

The new wording is good - very clear and (unusual for the IETF) provides a good rationale for the new requirements.

Some minor suggestions:

Section 10.1 (Requirements)

Just as you state that the IPsec Arch requires key mgmt, would it make sense to also mention that ESP is required and AH is optional, e.g.
"As required in [RFC4301], IPv6 nodes implementing the IPsec Architecture MUST implement ESP [RFC4303] and MAY implement AH [RFC4302]."

Section 10.2 (Transforms and Algorithms)

I would suggest also mentioning the crypto reqs for IKEv2, e.g. "The current set of mandatory-to-implement algorithms for IKEv2 are defined in 'Cryptographic Algorithms for Use in the Internet Key Exchange Version 2 (IKEv2)' [RFC4307].  IPv6 nodes implementing IKEv2 MUST conform to the requirements in [RFC4307] and/or any future updates or replacements to [RFC4307]."

Regards,
Sheila 
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of Thomas Narten [[email-masked]]
Sent: Wednesday, August 25, 2010 9:16 AM
To: [email-masked]
Subject: Node Requirements: Updated IPsec/IKEv2 text

New proposed text below.

Comments?

Thomas