Subject: [IPsec] question regarding ikev2 rfc

From: Joy Latten <[email-masked]>
Date: Fri, 01 Feb 2008 17:36:31 -0600

My colleagues and I implemented technology that uses "labeled" SAs
to enforce mandatory access control on the network. We introduced a
new security attribute to allow IKE to communicate an opaque 
security label when negotiating an SA. The IPsec DOI (rfc 2407)
contained a SIT_SECRECY and SIT_INTEGRITY but these were not 
sufficient. I also noticed they are not in IKEv2.

It had been our intention to create an addendum to IPsec DOI and
receive number from IANA for the security attribute. Thus allowing
interoperability. But IKEv2 has obsoleted IPsec DOI and IKEv1.

Perhaps it could be considered an addendum to IKEv2, but I am not
sure if it would be considered a transform type? Any suggestions
would be greatly appreciated.

regards,
Joy Latten

 

_______________________________________________
IPsec mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Sun, 3 Feb 2008 09:54:38 +0200

> would be greatly appreciated.

That would depend on what "labeled" SAs do.

IKEv2 does allow you to set up multiple parallel SAs, meaning multiple  
SAs with similar selectors. This was allowed to accommodate QoS and  
allow clusters of gateways to each have its own SA pair.

If what you need is a string label or blob that's meaningful to both  
sides of the negotiation, you may want to add a "sa_label"  
notification, because that does not really need negotiation, so  
there's no real need to add it to the SA payload. If this is something  
that does require negotiation, then please explain the need.

Hope this helps.

Yoav Nir

---

From: Stephen Kent <[email-masked]>
Date: Mon, 4 Feb 2008 14:47:57 -0500

>would be greatly appreciated.

RFC 2301 discussed using IPSO labels for mandatory access control, 
but there was so little interest in the community that the discussion 
was removed from 4301. I presume you're using IPSO or CIPSO, right?

Use of security labels would require additions to many parts of 
IPsec, e.g.,  the PAD and SPD, as well as IKE for carriage of labels 
to be used to negotiate child SAs.

Steve

---

From: Bill Sommerfeld <[email-masked]>
Date: Mon, 04 Feb 2008 15:10:05 -0500

> sufficient. I also noticed they are not in IKEv2.

I'm curious about why you found them insufficient -- I've prototyped
something similar (with sensitivity labels), and IKE v1's SIT_SECRECY
has so far worked for our purposes.

					- Bill