Re: [IPv6] Fwd: New Version Notification for draft-xu-ipsecme-risav-00.txt

[Mark Smith <[e-mail]>]

Hi Ben,

On Fri, 10 Mar 2023 at 01:37, Benjamin Schwartz <[e-mail]> wrote:
>
> Hi 6MAN,
>
> I wanted to let you know about RISAV, our early-stage draft currently being discussed in IPSECME.  The draft essentially proposes a global configuration mechanism for network-to-network IPsec between ASes.  Each IPsec association is "edge-to-edge", independent of any intermediate ASes such as transit providers, and is authenticated to the RPKI.
>
> The proposal instructs certain intermediate nodes (the AS Border Routers of the source and destination ASes) to modify packets (adding and removing IPsec protection).  As explained in Section 10.1 [1], we believe that this is logically compliant with existing IPv6 standards, but we would appreciate more input from 6MAN on any problems that might arise from the proposed arrangement, or improvements we should consider.
>

"In-Flight IPv6 Extension Header Insertion Considered Harmful"

IETF 106 slide deck  -
https://datatracker.ietf.org/meeting/106/materials/slides-106-6man-sessb-in-flight-ipv6-extension-header-insertion-considered-harmful-00
ID: https://datatracker.ietf.org/doc/html/draft-smith-6man-in-flight-eh-insertion-harmful-01

I'm a bit intrigued to know how people are going to do cost effective
and high speed EH chain processing past the fixed IPv6 header in
literally every packet being forwarded, looking for EHs it is to
process, when that network device doesn't hold the Destination Address
of the packet.

It seems to me that it would be a much easier thing to do if the
network device that is to process EHs is only looking for packets with
its own DA, which is what an outer tunnel header provides. Sure, the
tunnel header is network overhead, however it allows the decision as
to whether or not to try to process EHs in the packet as simple as
whether or not the packet's DA is local to the device or not i.e. a
FIB lookup.


Regards,
Mark.

> Thanks,
> Ben Schwartz, for the authors
>
> [1] https://datatracker.ietf.org/doc/html/draft-xu-ipsecme-risav-00#name-ipv6
>
> ---------- Forwarded message ---------
>
> A new version of I-D, draft-xu-ipsecme-risav-00.txt
> has been successfully submitted by Benjamin M. Schwartz and posted to the
> IETF repository.
>
> Name:           draft-xu-ipsecme-risav
> Revision:       00
> Title:          An RPKI and IPsec-based AS-to-AS Approach for Source Address Validation
> Document date:  2023-03-07
> Group:          Individual Submission
> Pages:          26
> URL:            https://www.ietf.org/archive/id/draft-xu-ipsecme-risav-00.txt
> Status:         https://datatracker.ietf.org/doc/draft-xu-ipsecme-risav/
> Html:           https://www.ietf.org/archive/id/draft-xu-ipsecme-risav-00.html
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-xu-ipsecme-risav
>
>
> Abstract:
>    This document presents RISAV, a protocol for establishing and using
>    IPsec security between Autonomous Systems (ASes) using the RPKI
>    identity system.  In this protocol, the originating AS adds
>    authenticating information to each outgoing packet at its Border
>    Routers (ASBRs), and the receiving AS verifies and strips this
>    information at its ASBRs.  Packets that fail validation are dropped
>    by the ASBR.  RISAV achieves Source Address Validation among all
>    participating ASes.
>
>
>
>
> The IETF Secretariat
>
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------