Subject: [geonet/its] Fwd: [ITS-NEWS] ITS Security: standard on Security header and certificate formats published

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 12 Jun 2015 17:04:00 +0200

Hello members of ITS at IETF,

ETSI ITS just announced a new publicly available document for "ITS
Security Header and certificate formats":
*ETSI TS 103 097 V1.2.1
<http://www.etsi.org/deliver/etsi_ts/103000_103099/103097/01.02.01_60/ts_103097v010201p.pdf>*

In it the "IPv6" word appears once:
> NOTE 2:  Payloads of type signed_external are needed to add a
> signature in a non-intrusive way to an existing protocol stack, e.g.
> for extending an IPv6 stack.

My comments are the following:

1. An IPv6 stack does not need extensions in order to support
    security.  Typically IPsec protocols are built-in into IPv6 stacks.
    Are the payloads of type signed_external using IPsec?

2. Are the signatures of ETSI ITS messages carried on IPv6 packets?
    This would be very advantageous for networking together automobiles.

Alex

-------- Message transféré --------
Sujet : 	[ITS-NEWS] ITS Security: standard on Security header and
certificate formats published
Date : 	Fri, 12 Jun 2015 13:45:10 +0000
De : 	Martin Arndt <[email-masked]>
Répondre à : 	Martin Arndt <[email-masked]>
Pour : 	[email-masked]

Dear all,

Please note that the following standard has been published recently. You
can download it for free via the link given below.

*ETSI TS 103 097 V1.2.1
<http://www.etsi.org/deliver/etsi_ts/103000_103099/103097/01.02.01_60/ts_103097v010201p.pdf>*

Intelligent Transport Systems (ITS);

Security;

Security header and certificate formats

Kind regards,

Martin

##############################

Martin ARNDT

Technical Officer

ETSI Operations (OPS)

Committee Support Centre (CSC)

Telephone: +33 4 92 94 42 49

Skype: Mr Wavelength

Email: [email-masked]

Web: http://www.etsi.org

##############################

---

From: Florian Friederici <[email-masked]>
Date: Thu, 18 Jun 2015 12:02:04 +0200

Dear Alex,

concerning your questions:

(personal opinion and experience)

1) 103097 uses an envelope format (SecuredMessage) for its payload.
signed_external is a way to create an non-envelope style security header
and signature, i.e. the payload is not inside the envelope, but at any
other place outside.

This was used historical during the development of GeoNetworking at a
time back when the networking layer had a different structure.

Today, there is no need for signed_external any more, and I doubt that
it will be used for extending an IPv6 stack soon.

2) For the v2v case, the network layer is GeoNetworking instead of IP.

Best regards
Florian

Florian Friederici, M.Eng.
Fraunhofer Institute for Open Communication Systems
Kaiserin-Augusta-Allee 31, 10589 Berlin, GERMANY
Tel: +49 30 3463 7342 Mail: [email-masked]

Am 12.06.2015 um 17:04 schrieb Alexandru Petrescu:
> _______________________________________________
> its mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/its

---

From: Alexandru Petrescu <[email-masked]>
Date: Fri, 19 Jun 2015 13:38:12 +0200

Hi Florian,

Thanks for the reply.

Le 18/06/2015 12:02, Florian Friederici a écrit :
> signed_external is a way to create an non-envelope style security
> header and signature, i.e. the payload is not inside the envelope,
> but at any other place outside.

Interesting.  The IPsec protocols of IPv6 also consider that
distinction: there is transport mode and tunnel mode. The tunnel mode is
a little bit like the 'envelope' concept of 103097, and the transport 
mode is an ESP or AH header and signature (like the non-envelope).

> This was used historical during the development of GeoNetworking at
> a time back when the networking layer had a different structure.

Ok.  Maybe there is ongoing development now at ETSI ITS that may
consider IPsec transport and tunnel modes.  The advantage of doing so is
that IPv6 applications can be reused extensively in vehicular
communications.

> Today, there is no need for signed_external any more, and I doubt
> that it will be used for extending an IPv6 stack soon.

Well.  If I understand correctly, the 'signed_external' is like the
transport mode of IPsec.

The transport mode of IPsec has some advantages over the tunnel mode:
the IPv6 packets are smaller (some headers are absent) - they may be
faster to process and transmit.  This may be important when the dynamics
of vehicles are higher, if I can say so.

> 2) For the v2v case, the network layer is GeoNetworking instead of

Well.  I think for the v2v case it would be good to consider IP at the
same time at GeoNetworking.  There are some advantages of doing so:
widely available cheap and reliable software, reuse of existing desktop
TCP/IP applications, instant end-to-end connectivity to the global
Internet, and, not least - programmer skillset.

Alex

>
> Best regards Florian
>
>
> Florian Friederici, M.Eng. Fraunhofer Institute for Open
> Communication Systems Kaiserin-Augusta-Allee 31, 10589 Berlin,
> GERMANY Tel: +49 30 3463 7342 Mail:
> [email-masked]
>
>> Security Header and certificate formats": *ETSI TS 103 097 V1.2.1
In it the "IPv6" word appears once:
>>> signature in a non-intrusive way to an existing protocol stack,
>>> e.g. for extending an IPv6 stack.
>>
>> security.  Typically IPsec protocols are built-in into IPv6
>> stacks. Are the payloads of type signed_external using IPsec?
>>
>> 2. Are the signatures of ETSI ITS messages carried on IPv6
>> packets? This would be very advantageous for networking together
>> automobiles.
>>
>> Alex
>>
>>
>>
>>
>> -------- Message transféré -------- Sujet :     [ITS-NEWS] ITS
>> Security: standard on Security header and certificate formats
>> published Date :     Fri, 12 Jun 2015 13:45:10 +0000 De :
>> Martin Arndt <[email-masked]> Répondre à :     Martin Arndt
>> <[email-masked]> Pour :     [email-masked]
>>
>>
>>
>> Dear all,
>>
>> Please note that the following standard has been published
>> recently. You can download it for free via the link given below.
>>
>> *ETSI TS 103 097 V1.2.1
>> _______________________________________________ its mailing list
>> [email-masked] https://www.ietf.org/mailman/listinfo/its
>
> _______________________________________________ its mailing list
> [email-masked] https://www.ietf.org/mailman/listinfo/its
>
>