Re: I-D.ietf-v6ops-cpe-simple-security-10

[Robert Moskowitz <rgm-ietf@htt-consult.com>]

I discussed this briefly with James during IETF 77.

HIP is on track to be reved for standards track.  It is assigned 
Protocol number 139, and should be treated by cpe-simple-security the 
same as IKE.  I will offer my best effort at text below.

I apologize for the few week delay, Passover came RIGHT after IETF.  And 
I SUPPOSE I should have pushed this 6 months ago while we were pushing 
to get HIP moving towards standards.  But that is water under the bridge...

On 03/29/2010 05:43 PM, james woodyatt wrote:
> concerned--
>
> This is to inform the chairs of the V6OPS working group that it is the sense of the editor of draft-ietf-v6ops-cpe-simple-security and the design team that worked most closely on it during its development, that the latest posted revision, i.e. -10, is ready for Working Group Last Call.

In sec 2.2 add at the end of the para:

HIP is also explicitly secured by definition, so this document 
recommends the DEFAULT operating mode permit Host Identity Protocol 
(HIP) flows to pass without filtering.

Add sec 3.2.6:

3.2.6  Host Identity Protocol (HIP)

Host Identity Protocol (HIP) offers greater flexibility and better 
overall security than the simple security of stateful packet filtering 
at network perimeters.  Therefore, residential IPv6 gateways need not 
prohibit HIP traffic flows.

REC-nn: In their DEFAULT operating mode, IPv6 gateways MUST NOT prohibit 
the forwarding of packets, to and from legitimate node addresses, with 
destination extension headers of type "Host Identity Protocol (HIP)" 
[RFC5201] in their outer IP extension header chain.

{note here, 5201-bis exists, but it will take a few months to finish 
this (we are NOT expecting a long process to add the agreed changes to 
5201).  The new RFC will be tagged as Standard, but will use the same 
protocol number.}

REC-nn: In their DEFAULT operating mode, IPv6 gateways MUST NOT prohibit 
the forwarding of packets, to and from legitimate node addresses, with 
an upper layer protocol of type "Encapsulating Security Payload (ESP)" 
[RFC4303] in their outer IP extension header chain.

{note this is the same text as REC-21, as HIP uses ESP in TRANSPORT mode.}

{note:  There is no easy equivalence of REC-23 with HIP due to its 
mobility.  In RFC 5206 we cover mobility and mid-box updating of moves.  
But do you want that here?  In HIP the SPI is all you can count on, as 
the IP address pair are mutable during the life of the SPI.}

In sec 8.1 add:

RFC 5201

Thank you.