Subject: I-D ACTION:draft-tschofenig-v6ops-secure-tunnels-00.txt (fwd)

From: Pekka Savola <[email-masked]>
Date: Fri, 18 Jun 2004 08:53:34 +0300 (EEST)

FYI -- 

Comments etc. of course welcome.

---------- Forwarded message ----------
Date: Mon, 14 Jun 2004 15:28:01 -0400
From: [email-masked]
To: [email-masked]
Subject: I-D ACTION:draft-tschofenig-v6ops-secure-tunnels-00.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories.

	Title		: Using IPsec to Secure IPv6-over-IPv4 Tunnels
	Author(s)	: H. Tschofenig, et al.
	Filename	: draft-tschofenig-v6ops-secure-tunnels-00.txt
	Pages		: 23
	Date		: 2004-6-14
	
   This document gives guidance on securing IPv6-in-IPv4 tunnels using
   IPsec.  No additional protocol extensions are described beyond those
   available with the revised IPsec framework.  IKEv2 is extensively
   used as an authentication and key exchange protocol to cover address
   configuration procedures, and the usage of the Extensible
   Authentication Procotol and NAT traversal capabilities is also
   described.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-tschofenig-v6ops-secure-tunnels-00.txt

To remove yourself from the I-D Announcement list, send a message to 
[email-masked] with the word unsubscribe in the body of the message.  
You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 
to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the username
"anonymous" and a password of your e-mail address. After logging in,
type "cd internet-drafts" and then
	"get draft-tschofenig-v6ops-secure-tunnels-00.txt".

A list of Internet-Drafts directories can be found in
http://www.ietf.org/shadow.html 
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:
	[email-masked].
In the body type:
	"FILE /internet-drafts/draft-tschofenig-v6ops-secure-tunnels-00.txt".
	
NOTE:	The mail server at ietf.org can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Jeroen Massar <[email-masked]>
Date: Fri, 18 Jun 2004 09:18:05 +0200

> Comments etc. of course welcome.

<SNIP>

>    Authentication Procotol and NAT traversal capabilities is also

IMHO it is a bit 'late' to start securing proto-41. It has been in use
already for too long and by too many people.

IPSEC on hosts and routers is near-to-none in existence, notez bien
that IPSEC in IPv6 is a mandatory item of IPv6 stacks and that many
stacks simply don't have it ;).
Setting up an IPSEC connection costs a lot of effort and negotiation.
Not even talking about the note about traveling the NAT's ;)

Thus this memo does have a good value for people who want to secure it
afterall, but I don't think that it will actually happen a lot due to
the above three items.

I didn't find any content issues in my quick glance.

Greets,
 Jeroen

---

From: Pekka Savola <[email-masked]>
Date: Fri, 18 Jun 2004 10:43:24 +0300 (EEST)

> already for too long and by too many people.

Just to be clear, this document doesn't intend to say, "OK, let's use 
IPsec for proto-41, and forget the unsecured version".  It's just 
trying to describe the scenarios and IPsec mechanisms which *could* be 
used for securing. :)
 
> afterall, but I don't think that it will actually happen a lot due to

I would be (pleasantly) surprised if it happened to a very large 
degree, but you never know. :)

In any case, this kind of document (or IPsec description in general) 
was required by the IESG for going forward with 
draft-ietf-v6ops-mech-v2.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Jeroen Massar <[email-masked]>
Date: Fri, 18 Jun 2004 09:47:11 +0200

> trying to describe the scenarios and IPsec mechanisms which *could* be 

Ack.

> draft-ietf-v6ops-mech-v2.

I understand that point as the proto-41 stuff and actually any tunneling
protocol that doesn't authenticate the sender allows more spoofing to
happen and that makes packets untraceable and able to bypass ingress
filters etc. which simply is not something that should be condoned.

Greets,
 Jeroen