Subject: [IPsec] Proposed work item: Labelled IPsec

From: Yaron Sheffer <[email-masked]>
Date: Sun, 29 Nov 2009 19:18:38 +0200

This work item proposes to extend IKEv2 (and IKEv1) so as to allow IPsec to be used in environments that require Mandatory Access Control. It is envisioned that this will be used by modern high-security operating systems, that go beyond the currently supported Multilevel Security (MLS).

Proposed starting point: http://tools.ietf.org/html/draft-jml-ipsec-ikev2-security-context-01 and http://tools.ietf.org/html/draft-jml-ipsec-ikev1-security-context-01.
 
Please reply to the list:
 
- If this proposal is accepted as a WG work item, are you committing to review multiple versions of the draft?
- Are you willing to contribute text to the draft?
- Would you like to co-author it?
 
Please also reply to the list if:
 
- You believe this is NOT a reasonable activity for the WG to spend time on.
 
If this is the case, please explain your position. Do not explore the fine technical details (which will change anyway, once the WG gets hold of the draft); instead explain why this is uninteresting for the WG or for the industry at large. Also, please mark the title clearly (e.g. "DES40-export in IPsec - NO!").

---

From: Stephen Kent <[email-masked]>
Date: Sun, 29 Nov 2009 19:59:35 -0500

I think that there has been insufficient discussion of whether those 
who wish to make use of IPsec to enforce mandatory access controls 
require the facilities described by the folks who have proposed this. 
At the WG meeting 2 weeks ago I made two observations:

	-  possible use of CIPSO for carrying labels had not been 
fully discussed
	- use of tunnel mode to protect such labels in the inner 
header did not appear to have been considered

I think it is incumbent on those who wish to pursue this work to 
provide more persuasive arguments. It also seems appropriate to have 
a discussion of whether mandatory, label-based controls are 
sufficiently mainstream to warrant bringing them back into IPsec at 
this time, or whether this is more of a research topic.

Steve