Subject: [IPsec] Announcing the USGv6 Testing Meeting at NIST

From: "Frankel, Sheila E." <[email-masked]>
Date: Wed, 21 Apr 2010 08:45:34 -0400

Announcing the USGv6 Testing Meeting at NIST.

To be held on Thursday May 20th 2010 in the AML Conference Room, 
Building 215 Room C103, from 9am till 5pm.

Following publication of the USG Profile NIST has established a testing 
program to determine products' compliance to USGv6 capabilities. There 
are at present 2 accreditors and 2 accredited test laboratories enrolled 
in the program, with more test laboratories in consideration.  July 2010 
marks the date when USG Federal Agencies begin to make IT acquisitions 
using the USGv6 profile version 1.0.  We wanted to host a public meeting 
to give:
    - a review of how the testing program is operating.
    - an opportunity for feedback from Stakeholders, including test 
laboratories, product vendors and USG Agencies.

Accordingly we seek discussion inputs to include:
    - statements from accredited and prospective test laboratories.
    - statements/questions and issues from Agencies and users.
    - statements, questions and issues from USGv6 product vendors.

Issues are expected to include:
    - testing operations and interlaboratory comparisons.
    - USGv6 capabilities and requirements.
    - Suppliers Declaration of Conformity.

There will also be some discussion of the forthcoming USGv6 profile 
version 2.  A full Agenda will be posted to signed up attendees closer 
to the day of the meeting.  Due to room size limitations there can be a 
maximum of about 70 participants at this meeting, and attendance from 
any one company may need to be limited. Reply to 
[email-masked] if you wish to participate, giving full 
name, company affiliation, title, contact details and whether you are a 
U.S. citizen. Please also let us know if you have issues you wish to 
present, with a maximum of 2 or 3 slides, and speaking time limited 
depending on the response.

For further information, please contact Stephen Nightingale ([email-masked])

---

From: "Davis, Terry L" <[email-masked]>
Date: Thu, 22 Apr 2010 09:05:59 -0700

Sheila

Like Latif said, THANK YOU!

As you know from the Seattle meeting with aviation industry representatives and the vendor community last fall, the Internet security protocols' interoperability is a key lynchpin in being able to ensure that the next generation of Internet enabled aircraft can establish secure communications in the global aviation environment.  Aviation continues to be concerned that current IPv4 versions of IPsec, IKE, and IKEv2 still have  vendor-to-vendor compatibility issues that would be difficult for us to overcome in a fully heterogeneous global environment.  In our environment, an aircraft is continually making and breaking security associations between different service providers and air traffic management entities as it transverses from country to country and continent to continent.  Thus our environment requires a very high degree of confidence in the ability of our systems to dynamically re-establish secure links with these new entities.

We would encourage that interoperability testing fully include versions of IPSec, IKE, and IKEv2 to ensure these issues do not continue with IPv6 on which the next generations of global air traffic management will reply on (ICAO Document 9896).  The testing ideally should demonstrate a vendor's system's ability to establish links with other vendors systems with minimal time and effort for setup and link customization as the ease-of-use and ease-of-deployment will be critical for a global aviation infrastructure.

Unfortunately I will be unable to attend as I will in ICAO meetings that week, part of which will focus on these same issues.

Take care

Terry L Davis, P.E
Boeing Technical Fellow

Aircraft Network and Security, Architecture & Strategy
Engineering Core - Avionics
Boeing Commercial Airplanes

Phone:  206-280-3716
Email:   [email-masked]

PS:  It would also seem likely that the other CI sectors would have similar IPv6 security interoperability needs.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]] On Behalf Of Latif
> LADID ("The New Internet based on IPv6")
> Sent: Thursday, April 22, 2010 7:04 AM
> To: 'Frankel, Sheila E.'; [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: Re: [Nav6tf] Announcing the USGv6 Testing Meeting at NIST
>
> Thanks Sheila! Good to see you working on IPv6 so vigorously
> recalling our
> days of work on IPsec back in 99.
>
> I have Copied the North American v6 Task Force members and
> the IPv6 Ready
> logo program team.
>
> Cheers
> Latif
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of
> Frankel, Sheila E.
> Sent: 21 April 2010 14:46
> To: [email-masked]; [email-masked]
> Subject: Announcing the USGv6 Testing Meeting at NIST
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [email-masked]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>
> _______________________________________________
> Nav6tf mailing list
> [email-masked]
> http://lists.ipv6forum.com/mailman/listinfo/nav6tf
>

---

From: "Latif LADID \(\"The New Internet based on IPv6\"\)" <[email-masked]>
Date: Thu, 22 Apr 2010 18:41:39 +0200

Terry,

You touch a core issue of the he IPv6 Ready Logo program.

The v6RL Phase II (Logo) includes IPsec interop testing.

Though we have stayed away at this staged from mandating IPsec per RFC to
give industry the time to put its arms around IPv6 issues first,

there a dozen of products that tested IPsec succesfully: 

http://cf.v6pc.jp/logo_db/approved_list_ph2.php

We have not yet defined Phase III which could include IPsec mandated. Now,
we need to carefully define the test profiles.

This needs a serious discussion before moving forward.

Cheers

Latif 

From: [email-masked] [mailto:[email-masked]] On
Behalf Of Davis, Terry L
Sent: 22 April 2010 18:06
To: 'Latif LADID ("The New Internet based on IPv6")'; 'Frankel, Sheila E.';
[email-masked]; [email-masked]
Cc: Whitlock, Stephen; [email-masked]; [email-masked];
[email-masked]'
Subject: Re: [Nav6tf] Announcing the USGv6 Testing Meeting at NIST

Sheila

As you know from the Seattle meeting with aviation industry representatives
and the vendor community last fall, the Internet security protocols'
interoperability is a key lynchpin in being able to ensure that the next
generation of Internet enabled aircraft can establish secure communications
in the global aviation environment.  Aviation continues to be concerned that
current IPv4 versions of IPsec, IKE, and IKEv2 still have  vendor-to-vendor
compatibility issues that would be difficult for us to overcome in a fully
heterogeneous global environment.  In our environment, an aircraft is
continually making and breaking security associations between different
service providers and air traffic management entities as it transverses from
country to country and continent to continent.  Thus our environment
requires a very high degree of confidence in the ability of our systems to
dynamically re-establish secure links with these new entities.

We would encourage that interoperability testing fully include versions of
IPSec, IKE, and IKEv2 to ensure these issues do not continue with IPv6 on
which the next generations of global air traffic management will reply on
(ICAO Document 9896).  The testing ideally should demonstrate a vendor's
system's ability to establish links with other vendors systems with minimal
time and effort for setup and link customization as the ease-of-use and
ease-of-deployment will be critical for a global aviation infrastructure.

Unfortunately I will be unable to attend as I will in ICAO meetings that
week, part of which will focus on these same issues.

Take care

Terry L Davis, P.E 
Boeing Technical Fellow 

Phone:  206-280-3716 

PS:  It would also seem likely that the other CI sectors would have similar
IPv6 security interoperability needs.