Subject: [IPsec] Difference between IPv4 and IPv6 IPsec

From: Hui Deng <[email-masked]>
Date: Sun, 11 Oct 2009 15:50:40 +0800

Dear IPsec forks,

May I get advice about the differnce between them:
1) IPv4 doesn't mandate the support IPsec, IPv6 also doesn't mandate
it based on RFC?
2) Most IPv4 hosts have(Linux, BSD, Windows) by default implemented
IPsec(IKE), but don't launch it, need more configuration?
    Most IPv6 hosts haven't by default implemented IPsec(IKE), it need
further download and configuration?
3) IPv4 IPsec need traversal NAT, but IPv6 don't need it, so it could
support more about end to end other than site to site.
4) IPv6 IPsec support is based on extension header which is different
from IPv4, it may more closer to the kernal level implementation.

thanks for the discussion.
best regards,

-Hui

---

From: Yoav Nir <[email-masked]>
Date: Sun, 11 Oct 2009 12:15:21 +0200

Hi Hui

I think there is very little difference between IPv4 and IPv6 as  
regards to IPsec. See below

> 1) IPv4 doesn't mandate the support IPsec, IPv6 also doesn't mandate

IPv4 does not mandate it, because IPv4 predates IPsec. RFC 4294 says  
in section 8.1:

    Security Architecture for the Internet Protocol [RFC-4301] MUST be
    supported.

> further download and configuration?

IPv6 hosts, like IPv4 hosts, run Linux, BSD, Windows or some other OS.  
With most of them, the latest versions support IPv6 for IKE and IPsec.

> support more about end to end other than site to site.

That is assuming that IPv6 does not have NAT. I don't think we have  
enough implementation experience to say that for sure.

> from IPv4, it may more closer to the kernal level implementation.

I don't see why this would necessarily be true.

---

From: Zhen Cao <[email-masked]>
Date: Wed, 14 Oct 2009 23:29:17 +0800

On Sun, Oct 11, 2009 at 6:15 PM, Yoav Nir <[email-masked]> wrote:
> Hi Hui
>
> I think there is very little difference between IPv4 and IPv6 as regards to
> IPsec. See below
>
> IPv4 does not mandate it, because IPv4 predates IPsec. RFC 4294 says in
> section 8.1:
>
> IPv6 hosts, like IPv4 hosts, run Linux, BSD, Windows or some other OS. With
> most of them, the latest versions support IPv6 for IKE and IPsec.

I guess we do not need tunnel model for IPv6 ipsec?

> That is assuming that IPv6 does not have NAT. I don't think we have enough
> implementation experience to say that for sure.

Can it be at-least considered one advantage of IPv6 IPSEC?

Another point is: "One possible advantage for IPv6 IPsec is that
IPv6’s extension header chaining feature, which is not present in
IPv4, could be used to authenticate a secure host-to-host scenario
exchange to a third party gateways which would provide authorized
access into and out of secure enclaves". -quote from
http://www.commandinformation.com/blog/?p=98. Is this valid?

Thanks for discussion.

> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>
>

---

From: Stephen Kent <[email-masked]>
Date: Wed, 14 Oct 2009 12:48:05 -0400

At 11:29 PM +0800 10/14/09, Zhen Cao wrote:
>O...

what makes you say that? unnelT mode is still needed for SG-SG SAs, 
or host-SG SAs.

>Can it be at-least considered one advantage of IPv6 IPSEC?

Not really.

>IPv6's extension header chaining feature, which is not present in

I think that is an unlikely scenario, if only due to key management issues.

Steve

---

From: "Khan, Fayyaz" <[email-masked]>
Date: Wed, 14 Oct 2009 19:50:02 +0200

I would also add a few cents.

>what makes you say that? unnelT mode is still needed for SG-SG SAs, 

Also tunnel mode will still be required for IPv6 to 4 tunnels as long as
IPv4 addresses exist and IPv6 nodes need to be interoperable with them.

>>  That is assuming that IPv6 does not have NAT. I don't think we have
enough

>Not really.

Further motivations for NAT in IPv6 includes need for private networks
i.e. a company wants to only have one machine to communicate with
external world so every computer on that private network goes through
that single machine.

Also, cost of owning a live ip vs. hosting a private network behind a
single live ip would still be attractive, even for security reasons too.

---

From: Zhen Cao <[email-masked]>
Date: Thu, 15 Oct 2009 10:27:18 +0800

On Thu, Oct 15, 2009 at 1:50 AM, Khan, Fayyaz <[email-masked]> wrote:
>>  > IPv6 hosts, like IPv4 hosts, run Linux, BSD, Windows or some other
> OS. With
>>  > most of them, the latest versions support IPv6 for IKE and IPsec.
>>
I thought transport mode is enough for all requirements...I must be
wrong. Thanks.