RE: AERO/OMNI dropping support for SEND/CGA

Hi Fred,
SeND needs a refresh. CGA looks ridicules now in principle. You should not use it.

I am not sure: does it make sense to develop something else instead (based on ecliptic curves).
As Fernando pointed many times: many things in ND could be resolved only by digital signature (he calls it "untrusted model").
But as we see: market has rejected PKI. Digital signature is not useful without proper key management.
IMHO: it is better to keep digital signature as a separate standard.
Therefore, if you have cycles for separate OMNI addendum, then it is better to have it for completeness. If not - not much to lose now.
But make sure that Open Key Cryptography and PKI (!) would be possible to add later.
What if something would be innovated in PKI and it became popular?
Reminder: PKI is needed not just for ND. Enterprises have the big pressure to protect all applications by TLS.
Your vertical would probable lead on PKI adoption.

As an alternative: you could talk with IT and Security people in your vertical: if they believe in massive deployment of PKIs then you have to have Digital Signature for ND.
It would still not guaranty that it would be used, because hosts would need support for it at ND level, but it is already the good situation to try.
Hence again, better to keep it in separate specification.

Eduard
> -----Original Message-----
> From: ipv6 [mailto:ipv6-bounces@ietf.org] On Behalf Of Templin (US), Fred L
> Sent: 1 декабря 2020 г. 1:12
> To: ipv6@ietf.org
> Subject: AERO/OMNI dropping support for SEND/CGA
> 
> Folks, this is a big decision point for the AERO/OMNI drafts but I am preparing to
> drop support for SEND/CGA (RFC3971; RFC3972). This means that IPv6 ND
> message authentication on OMNI interfaces will use a simple HMAC the same as
> is done for Teredo (RFC4380; RFC6081). If anyone knows why that might cause
> problems, it would be best to speak up now.
> 
> Fred
> 
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> ipv6@ietf.org
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------