Re: IPv6 only host NAT64 requirements?

On Sun, Nov 12, 2017 at 6:51 PM Ole Troan <otroan@employees.org> wrote:

> At the hackathon there was quite a bit of testing of IPv6 only hosts with
> access to the IPv4 network via a NAT64.
>
> While many applications work well on a classic IPv6 only host, there are a
> few things required to make all applications work.
>
> - Must be able to do NAT64 prefix discovery (RFC6052)
> - Synthesise IPv6 address from an IPv4 literal (RFC7050)
>
> This is to be able to deal with IPv4 address literals. Which are common in
> protocols like SIP/ICE/STUN.
> These can be implemented directly in applications, or it can be
> implemented in the host stack (although application might still have to
> change).
>
> - Should do local DNS64 to support DNSSEC (RFC6147)(if you do validation).
>
> A DNS64 service in the network looks like a man in the middle attack, so
> to support DNSSEC, validation should happen before synthesizing, and must
> be done on the host itself.
>
> If this is the direction we want to go. Encourage IPv6 only host
> deployments (as opposed to dual stack hosts), are these requirements we'd
> like to add to the IPv6 node requirements document? Somewhere else?
>

I am not optimistic on the demand / need / value of dnssec in any scenario
....let alone an ipv6-only host validating an ipv4-only dns name. If the
folks operating this service cared, they could operate the server with
signed v6 names.  It is more reasonable in todays internet to asked the
server (lets assume most signed name scenarios are servers) to be setup
right (with v6). There is not a compelling reason why having v6 is
unattainable today for named nodes.

With 20 years of experience with ipsec as an ipv6 node requirement, i think
it is safe to say the IETF foisting requirents into the network layer has
caused more confusion (ipv6 is more secure because everything has ipsec!)
and hacks (ospfv3 ...) than actual true security benefit.

> Best regards,
> Ole
>
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>