Re: [Iotops] [OPSAWG] Status update on MUD-IoT-DNS-Considerations

[Michael Richardson <[e-mail]>]

Carsten Bormann <[e-mail]> wrote:
    > On 2021-07-15, at 21:41, Michael Richardson <[e-mail]> wrote:
    >>
    >> How, does an authoritative (or even authoritarian) firewall identify itself
    >> such that traffic that needs to traverse it can self-identify?
    >> APN has this problem.
    >> I described this problem back in 1996:
    >> https://www.ietf.org/archive/id/draft-richardson-ipsec-aft-00.txt
    >> https://www.ietf.org/archive/id/draft-richardson-ipsec-traversal-01.txt

    > I think one trap that many of these efforts fell into was that they
    > tried to be small attachments to existing technology.

In 1996, I'm not sure I'd say that IPsec was "existing" :-)
The pushback that I got was that it seemed complex.
NAT44 was not established, but it was visible in the form of actual security gateways.

    > Looking at these uses cases we need to derive an understanding of the
    > parties involved and what security (and “trust”) relationships they
    > have, and what granularity of authorization of “desirable” traffic is
    > required, desired, and achievable.

Some things have progressed in 25 years.

RPKI exists, although it is not well deployed.  (My understanding is that one
reason it is slow in ARIN region is that ARIN won't let you have their public
key until you assure them you won't sue...)
RPKI would allow a node to say, "I am authoritative for 2001:db8:1234/48"

This could be very powerful if used correctly.

--
Michael Richardson <[e-mail]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide