Re: [arch-d] ipv4 and ipv6 Coexistence.

[Guntur Wiseno Putra <[e-mail]>]

Dear architecture-discuss,

I am struggling to read on what Pekka Nikkander made about "IPv4 & IPv6" in
"Reflection on Architecture" (2005) where he mentioned about the time of
architecture-discuss' beginning:


(P. Nikander:)

"...Looking at the network of today, I strongly feel the pain of the
current architecture’s cracking and squeaking. Consequently, I believe that
we – the wider IETF community responsible for Internet technology – need to
re-think the architecture. We need to find a way to re-create the core of
the Internet in a way that leads to a new era of innovation and
intellectual prosperity....

... ( What we perhaps don’t consider very often is the fact that there are
huge asset values embedded in various parts of the network.)As the
slower-than-expected migration to IPv6 has amply demonstrated, some parts
of the current Internet are painfully hard to change. This makes any
long-term architectural thinking and planning difficult.

(While we can at most work towards understanding emergent complexity in the
first place, there is a great deal we can do about architectural
complexity... )

... We need some kind of an architectural vision and a related transition
path; an idea of where we are heading and perhaps how we could get there.

My vision includes peaceful co-existence of both IPv4 and IPv6 for a fairly
long time to come. While I would like to see a day when the last IPv4 node
is shut down, it is more likely that only future generations will see that
happening. In my vision it is possible to use any application I want
wherever I am and whatever kind of connection I may have. Indeed, I imagine
being able to use multiple wireless networks most of the time, and at least
one almost always. I dream of once more being able to communicate with
anyone, anywhere on the Internet, independent of the application we want to
use, not artificially hindered by NATs or other non-premeditated middle
boxes. Finally, in my vision we have baseline security as a built-in
feature of the architecture, providing cryptographically strong end-to-end
security and sufficient hooks for attaching different kinds of security
infrastructures, some based on organisational management and some based on
grassroots attempts to model interpersonal human trust relationships with
decentralised authorisation systems.

It looks very likely that fulfilling my vision requires adding a new layer,
a new “waist”, to the architecture [7]. We have to implement mobility,
multi-homing, and the envisioned baseline security somewhere in the stack.
If we want connectivity to span the partition between IPv4 and IPv6
networks, it looks necessary to build the functionality on the top of the
existing hop-by-hop functionality of the IP layer....

(Once we start to consider how to introduce the changes needed to progress
towards any vision, it becomes apparent that the two hardest-to-change
assets are the existing routing infrastructure and the set of all existing
applications. But network transparency is exactly what we should
re-establish...)

Using a term that Brian Carpenter recently coined, I propose that we aim at
providing new Architected Network Transparency (ANT). There seem to be
three or four potential migration paths towards ANT. One possibility is to
utilise a Cryptographically Generated Addresses (CGA) [8] based security
model in the IPv6 Site Multi-homing by Inter-Mediation (SHIM6) [9] to
provide end-to-end security and mobility even when IPv6 traffic is
shimmed....

... (Toward the ANT) One possible means might be Keyed Hash Identifiers
(KHI, pronounced as the Greek letter ?) [14], currently subject to heated
debate in the int-area and ipv6 mailing lists. Whether KHIs should be
considered as an important but transitory stepping stone or as despicable
opening of the flood gates to occupy the IPv6 address space with varmints
remains to be seen.

...".







Regard,
Guntur Wiseno Putra

Pada Kamis, 27 Februari 2020, Toerless Eckert <[e-mail]> menulis:

> On Wed, Feb 26, 2020 at 10:45:29AM +0000, Stephen Farrell wrote:
> > On 26/02/2020 10:21, Stewart Bryant wrote:
> > > "The head of MI5 has urged technology companies to give the security
> > > services â?????exceptionalâ???  access to encrypted messages
> >
> > And in other, equally shocking, news: the sun will rise tomorrow;-)
>
> https://en.wikipedia.org/wiki/The_empire_on_which_the_sun_never_sets
> ;-))
>
> > If you do want to rehash the cryptowars debate again,
>
> Not at all. But for example enterprises often use HTTPs proxies
> for firewalling, intrusion detection, proprietary data leakage
> prevention and the like. I am not aware we have stablished standards
> for such desirable behavior. In fact there are issues with the expected
> end-to-end krypto security when you bring in such trusted middle-men.
> (e.g.: undesirable cert spoofing). There are no browser standards
> for a three party trust-model AFAIK.
>
> Right now, we have only those global commercial players positioning
> them as trusted third parties. Even DoH IMHO falls into this play.
> And then selling customer data collected, at least when they have
> some entity operating outside europe (GDPR data leakage prevention).
>
> All those IoT devices that export unbeknownst do the user all type
> of collected user data to a cloud. We could come up with mandatory
> published data models, force the connection through a trusted third
> party device that can then do semantic filtering. Aka: i rather
> want to be able to control than just trust GDPR statements.
>
> Likewise i think we could define better behaving firewall policies
> in the fashion did it for NAT with BEHAVE, e.g.: more visibility
> of policy for better diagnostics.
>
> Etc. pp. Just brainstorm what positive evolution we could promote
> through IETF work for more security. The IETF end-to-end encryption
> laurels nice but not enough.
>
> > maybe at least change the subject line? If doing so,
> > and I hope you decide not to, because there's no gain,
> > please recognise that there are many (me included) who
> > do not share the views you quoted for sound technical
> > reasons (e.g. [1] is perhaps the most-cited recent
> > paper on that) that have garnered rough consensus in
> > the IETF every time we've done that rehashing.
>
> Stating that we would like to see IETF solve problems doesnt
> mean we agree to those regurgitated security agency memes.
> Instead, i see these memes as the real risks, because the
> public has shown to give in to the ongoing "tough on crime"
> pounding with really bad outcomes. So we really need better,
> alternative models for more security in addition to the
> ongoing push back against that type of nonsense.
>
> Cheers
>     Toerless
>
> > S.
> >
> > [1] Abelson, Harold, et al. "Keys under doormats: mandating insecurity
> > by requiring government access to all data and communications." Journal
> > of Cybersecurity 1.1 (2015): 69-79.
> > https://www.cs.yale.edu/homes/jf/paper-keys-under-doormats-CSAIL.pdf
> >
> >
> >
> >
> >
>
> pub   RSA 4096/7B172BEA 2017-12-22 Stephen Farrell (2017) <
> [e-mail]>
> > sub   RSA 4096/36CB8BB6 2017-12-22
> >
>
>
>
>
> > _______________________________________________
> > Architecture-discuss mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/architecture-discuss
>
>
> --
> ---
> [e-mail]
>
> _______________________________________________
> Architecture-discuss mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/architecture-discuss
>