Subject: Interest to have as an WG item: draft-tschofenig-v6ops-secure-tunnels-03.txt

From: "Soininen Jonne (Nokia-NET/Helsinki)" <[email-masked]>
Date: Mon, 03 Jan 2005 15:53:15 +0200

Hello v6ops WG,

first of all, happy new year to everybody, and it is time to get back to
work. 

(Chair hat on)
The authors of draft-tschofenig-v6ops-secure-tunnels have requested the
draft to be adopted as a WG item. I would like to give two (2) weeks of
time for the discussion, putting the deadline to 18.1.2005. 

The draft can be found at
http://www.ietf.org/internet-drafts/draft-tschofenig-v6ops-secure-tunnels-03.txt

(Chair hat off)

Cheers,

Jonne

-- 
Jonne Soininen
Nokia

Tel: +358 40 527 46 34
E-mail: [email-masked]

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Mon, 03 Jan 2005 17:39:30 +0100

Hi Jonne,

I'm ok with this document being accepted as WG item.

I will suggest a couple of changes:

1) There are several mentions to 6-over-4 and IPv6-over-IPv4 or similar
(including the document title !), which should be 6-in-4/IPv6-in-IPv4, to
avoid confusion between 6in4 and 6over4.

2) A minor one, there are several places in the document where all-upper
case is used for referring to both IPv4 and IPv6. I think it will be better
to use the normal casing (IPv4 and IPv6 instead of IPV4 and IPV6), specially
to be consistent across all the document.

A more substantial comment, not negative to this document, but the WG
process itself, which is demonstrated by your question to the WG on getting
this document accepted as WG item. Is once more very funny and unfair that
getting a document as WG item or not is a closed thing, instead of an open
procedure for any author when the work is clearly in the scope of the
charter.

I still remember that there was a decision, not clear for me and which I
don't agree at all, 2 or 3 IETF meetings ago, by which all the work was put
"on-hold" and no more work accepted as WG item.

Clearly, now this has been changed, so I understand that the fair way to go
now, will be that the rest of the authors can ask the same question on those
documents that are within the charter scope. Right ?

Regards,
Jordi

> De: "Soininen Jonne (Nokia-NET/Helsinki)" <[email-masked]>
> Responder a: <[email-masked]>
> Fecha: Mon, 03 Jan 2005 15:53:15 +0200
> Para: ext Pekka Savola <[email-masked]>
> CC: <[email-masked]>
> Asunto: Interest to have as an WG item:
> draft-tschofenig-v6ops-secure-tunnels-03.txt
> 
> Hello v6ops WG,
> 

**********************************
Madrid 2003 Global IPv6 Summit
Presentations and videos on line at:
http://www.ipv6-es.com

This electronic message contains information which may be privileged or confidential. The information is intended to be for the use of the individual(s) named above. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, including attached files, is prohibited.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 14 Jan 2005 13:30:07 +0200 (EET)

Folks,

There has been only one comment about this.  Please speak up your 
thoughts.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Alain Durand <[email-masked]>
Date: Fri, 14 Jan 2005 05:06:28 -0800

Well, I'm not a security expert, far from that, so I'm not sure I can 
comment on the
quality of the security assertions.
However, at fist glance, it seems that this is a tutorial on ikev1 & 
ikev2
in the context of IPv6...
I other words,  it is unclear to me why we need this document in v6Ops
and why it is not homed in a security related wg IF there is a need for 
such a document.

On another note, some of the techniques described here may be useful in 
the context of v6tc...

	- Alain.

---

From: Pekka Savola <[email-masked]>
Date: Fri, 14 Jan 2005 16:08:34 +0200 (EET)

On Fri, 14 Jan 2005, Alain Durand wrote:
> Well, I'm not a security expert, far from that, so I'm not sure I 
> can comment on the quality of the security assertions. However, at 
> fist glance, it seems that this is a tutorial on ikev1 & ikev2 in 
> the context of IPv6... I other words, it is unclear to me why we 
> need this document in v6Ops and why it is not homed in a security 
> related wg IF there is a need for such a document.

Please take a bit closer look; it's not just a tutorial on IKE with 
IPv6, it describes how to use IKE and IPsec to set up IPv6-in-IPv4 
tunnels.

The background here is that:

  1) trans-mech RFC basically said, "use IPsec if you need security";
     this is no longer considered sufficient, and it is required to
     describe how exactly you use IPsec if you propose to use it.

  2) draft-ietf-v6ops-mech-v2 was revised to just say, "we describe the
     use of IPsec for v6-in-v4 tunnels in another document" [this one].

  3) Steve Bellovin, while he was security AD, requested
     description of IPsec usage (or this document) at his review of
     draft-ietf-mech-v2-xx; he wouldn't want to let draft-ietf-mech-v2
     go forward to the RFC editor's queue before this is done, so
     draft-ietf-v6ops-mech-v2 has been practically stalled from
     completion for the last 4 months or so.

Moreover,

  - it is the responsibility of the WG producing a protocol to document
    how its security works, not the security area (i.e., the security
    area does not have the responsibility to document how to use IPsec
    to secure v6-in-v4 configured tunnels)

  - I suggested that this work could also be done as an individual
    submission to Steve (while he was still AD), but he thought v6ops
    was a better idea <g>.

So, there is quite a bit of history why this document came to be, and 
why it has been proposed in v6ops, not somewhere else.

However, it may not have been clear enough why exactly it _seems_ that 
there is no other option than to do it here.

Does this change your view on the document?  Any comments from the 
others?

---

From: Alain Durand <[email-masked]>
Date: Fri, 14 Jan 2005 06:15:45 -0800

> Does this change your view on the document?  Any comments from the 

Yes, it does change my opinion. A boilerplate explaining the history of 
this document would be useful.

	- Alain.