Subject: RE: "IPv6 transition security" problem statement from a workshop that never happened

From: "Bound, Jim" <[email-masked]>
Date: Thu, 14 Aug 2003 23:33:01 -0400

Rob,

These are well understood in the deployment efforts for IPv6 and will be
addressed operationally too.  Also key management is not a problem for
many users with IPsec if they own the network and the PKI within their
Intranet or Fully-Owned Internet.  Clearly PKI as I roam from U.S. to
China is an issue.

thanks
/jim

> -----Original Message-----
> From: Rob Austein [mailto:[email-masked]] 
> Sent: Wednesday, August 13, 2003 1:25 AM
> To: [email-masked]
> Subject: "IPv6 transition security" problem statement from a 
> workshop that never happened
> 
> 
> As promised in Vienna, here's the draft problem statement 
> that I wrote for the IAB workshop on "IPv6 Transition 
> Security" that never happened.  I'm sending this to the WG in 
> the hopes that it will be useful.  If you think it's a waste 
> of time, well, feel free to ignore it, or print it out and 
> throw darts at it, or whatever amuses you.
> 
> Credit for any of this that's useful goes to a long list of 
> people, including but not limited to the folks who chaired 
> this WG or were on the IAB or IESG when I was writing this 
> text late last year.  If something in this is wrong or 
> offends you, blame me, not them.
> 
> See the minutes from IETF57 for background on the origin of 
> this text. In brief: late last year we started trying to pull 
> together a workshop on these topics, but it never quite 
> jelled, in part because upon examination some of these topics 
> didn't seem particularly well suited to the IAB workshop format.
> 
>

---

From: Randy Bush <[email-masked]>
Date: Thu, 14 Aug 2003 20:56:31 -0700

> These are well understood in the deployment efforts for IPv6

great!  where will we find them documented?

> and will be addressed operationally too.

as i am a bit familiar with some actual operational v6 networks,
i really look forward to this.

> Also key management is not a problem for many users with IPsec if
> they own the network and the PKI within their Intranet or
> Fully-Owned Internet.

this will be a great relief to all those folk going through key
management hell with ipsec.

jim, we're from engineering, not marketing.  and so are you.  give
us a break.

these are non-trivial issues.  they need to be actually addressed.
they can be.  but not by pretending they're already solved.

randy