Re: [secdir] Discussion from the Security Directorate

[Fred Baker <[e-mail]>]

additional drafts:

http://tools.ietf.org/html/draft-despres-6rd
   "IPv6 Rapid Deployment on IPv4 infrastructures (6rd)", Remi Despres,
   7-Apr-09, <draft-despres-6rd-03.txt>

http://tools.ietf.org/html/draft-despres-sam
   "Scalable Multihoming across IPv6 Local-Address Routing Zones
   Global-Prefix/Local-Address Stateless Address Mapping (SAM)", Remi  
Despres,
   13-Jul-09, <draft-despres-sam-03.txt>

http://tools.ietf.org/html/draft-despres-6rd
   "IPv6 Rapid Deployment on IPv4 infrastructures (6rd)", Remi Despres,
   7-Apr-09, <draft-despres-6rd-03.txt>

http://tools.ietf.org/html/draft-despres-sam
   "Scalable Multihoming across IPv6 Local-Address Routing Zones
   Global-Prefix/Local-Address Stateless Address Mapping (SAM)", Remi  
Despres,
   13-Jul-09, <draft-despres-sam-03.txt>

http://tools.ietf.org/html/draft-denis-behave-v4v6exthdr
   "IPv6 destination header option for IPv4 translator mapping  
notification",
   Remi Denis-Courmont, 9-Mar-09, <draft-denis-behave-v4v6exthdr-01.txt>

http://tools.ietf.org/html/draft-ietf-behave-v6v4-framework
   "Framework for IPv4/IPv6 Translation", Fred Baker, Xing Li,  
Congxiao Bao,
   Kevin Yin, 6-Jul-09, <draft-ietf-behave-v6v4-framework-00.txt>

http://tools.ietf.org/html/draft-ietf-behave-v6v4-xlate
   "IP/ICMP Translation Algorithm", Xing Li, Congxiao Bao, Fred Baker,
   26-Jun-09, <draft-ietf-behave-v6v4-xlate-00.txt>

http://tools.ietf.org/html/draft-ietf-behave-v6v4-xlate-stateful
   "NAT64: Network Address and Protocol Translation from IPv6 Clients  
to IPv4
   Servers", Marcelo Bagnulo, Philip Matthews, Iljitsch van Beijnum,  
11-Jul-09,
   <draft-ietf-behave-v6v4-xlate-stateful-01.txt>

http://tools.ietf.org/html/draft-ietf-behave-dns64
   "DNS64: DNS extensions for Network Address Translation from IPv6  
Clients to
   IPv4 Servers", Marcelo Bagnulo, Andrew Sullivan, Philip Matthews,  
Iljitsch
   van Beijnum, 4-Jul-09, <draft-ietf-behave-dns64-00.txt>

http://tools.ietf.org/html/draft-xli-behave-ivi
   "The CERNET IVI Translation Design and Deployment for the IPv4/IPv6
   Coexistence and Transition", Xing Li, Congxiao Bao, Maoke Chen,  
Hong Zhang,
   Jianping Wu, 13-Jun-09, <draft-xli-behave-ivi-02.txt>

http://tools.ietf.org/html/draft-wu-softwire-4over6
   "4over6 Transit Solution using IP Encapsulation and MP-BGP  
Extensions",
   Jianping Wu, Yong Cui, Xing Li, Mingwei Xu, Chris Metz, 14-Apr-09,
   <draft-wu-softwire-4over6-02.txt>


On Jul 30, 2009, at 1:56 PM, Fred Baker wrote:

> who is "we"?
>
> I would suggest that you make your request to the chairs of the  
> various working groups doing the work. These include 6man  
> (designated custodian of all things IPv6 and therefore of RFCs 3053,  
> 3056, 4213, and 5214), behave (translation), and softwire (tunnels).
>
> On Jul 29, 2009, at 8:45 PM, Tina wrote:
>
>> Hi again:)
>> Some clarifications for the slides.
>>
>> a. security assessment, to evaluate the security of a transition  
>> technology. What aspects do we need to judge and consider?
>> b. function recommendation, to reduce the security threat of some  
>> kind of transition technology. When deploy this technology, what  
>> functionalities should the device need to have?
>>
>>
>> B. R.
>> Tina
>> http://tinatsou.weebly.com/contact.html
>>
>>
>>
>> On Jul 29, 2009, at 5:23 PM, Tina wrote:
>>
>>> Hi Fred and David,
>>> The slides were sent to OPS ADs, and we discussed it a bit in OPS- 
>>> DIR work lunch on Monday. According to the suggestion from Dan, I  
>>> forwarded the slides to the WG chairs of v6ops and opsec.
>>>
>>> Then Fred forwarded to SEC-DIR.
>>>
>>> I mentioned Fred's email during SEC-DIR work lunch on Tuesday.  
>>> There was discussion.
>>>
>>> I went to Tuesday v6ops session before my slides were taken. Then  
>>> I left for some personal emergency reasons. Therefore I was not  
>>> able to present the slides. But Fred did it.
>>>
>>> The slides will be presented in OPS Area Opening meeting in the  
>>> Large Stage between 15:10 to 16:10.
>>>
>>>
>>> B. R.
>>> Tina
>>> http://tinatsou.weebly.com/contact.html
>>>
>>>
>>> On Jul 29, 2009, at 5:04 PM, Fred Baker wrote:
>>>
>>>> It was presented to the ops directorate as "from the security  
>>>> directorate" on Monday, and shipped off to my working group.
>>>>
>>>> OK, Tina, over to you...
>>>>
>>>> On Jul 29, 2009, at 11:30 AM, David Harrington wrote:
>>>>
>>>>> Hi,
>>>>>
>>>>> I have a question.
>>>>> I am a member of the Security Directorate, and I do not remember  
>>>>> any
>>>>> discussion leading to this powerpoint presentation or request. I  
>>>>> may
>>>>> have missed a SECDIR session. I didn't find discussion of this
>>>>> powerpoint presentation in the secdir archives prior to this week.
>>>>>
>>>>> Is this a "Discussion from the Security Directorate"? If so,  
>>>>> when was
>>>>> this discussed? Has the SECDIR reviewed this powerpoint slide  
>>>>> deck and
>>>>> approved it being sent to working groups?
>>>>>
>>>>> David Harrington
>>>>> [e-mail]
>>>>> [e-mail]
>>>>> [e-mail]
>>>>>
>>>>>
>>>>>> -----Original Message-----
>>>>>> From: [e-mail]
>>>>>> [mailto:[e-mail]] On Behalf Of Fred Baker
>>>>>> Sent: Tuesday, July 28, 2009 10:49 PM
>>>>>> To: Joel Jaeggli
>>>>>> Cc: 6man Chairs; [e-mail]; [e-mail];
>>>>>> Kurt Erik Lindqvist; Joe Abley; Softwire Chairs;
>>>>>> [e-mail]; [e-mail]; Tina
>>>>>> TSOU; [e-mail]; Behave Chairs
>>>>>> Subject: Re: [secdir] Discussion from the Security Directorate
>>>>>>
>>>>>> I'm not arguing against the request. I'm asking what it is
>>>>>> requesting,
>>>>>> as I have no idea...
>>>>>>
>>>>>> I think I know what a threat analysis is.
>>>>>>
>>>>>> What is a "security assessment" apart from a "threat  
>>>>>> assessment"? I
>>>>>
>>>>>> told v6ops (which does not develop transition technologies, by
>>>>>> charter, and therefore is the absolute wrong place to send
>>>>>> this) that
>>>>>> I thought it might mean an assessment of how we might mitigate  
>>>>>> the
>>>>>> threats. Absent any answers from the Security Directorate  
>>>>>> responsive
>>>>>
>>>>>> to the question, I have no idea whether I was correct.
>>>>>>
>>>>>> And what on God's Green Earth is a "function recommendation"? I  
>>>>>> have
>>>>>
>>>>>> no idea what you want.
>>>>>>
>>>>>> Nobody from the Security Directorate was there today to deliver  
>>>>>> the
>>>>>
>>>>>> message. If I were developing a threat assessment of that
>>>>>> protocol...
>>>>>> let's see: delivered to the wrong WG by someone who didn't know  
>>>>>> what
>>>>>
>>>>>> the message was supposed to be using slides he didn't  
>>>>>> understand and
>>>>>
>>>>>> the security directorate didn't take the time to explain...
>>>>>>
>>>>>> On Jul 27, 2009, at 2:08 PM, Joel Jaeggli wrote:
>>>>>>
>>>>>>> I'd probably tune the slides a bit still:
>>>>>>>
>>>>>>> 	Security problems show up in deployment and use, these cannot
>>>>> be
>>>>>>> 	thought out at all when designing the protocols
>>>>>>>
>>>>>>> Is an assertion you'll get pushback on. we have signficant
>>>>>> operational
>>>>>>> experience with variations on many of the proposed or deployed
>>>>>>> transition mechanisms. necessarily that experience informs both
>>>>> our
>>>>>>> current thinking and the desirability of any particular  
>>>>>>> approach.
>>>>>>>
>>>>>>> bump in the wire type transition technologies certainly are an
>>>>> area
>>>>>>> potential concern for opsec
>>>>>>>
>>>>>>> Fred Baker wrote:
>>>>>>>> Thanks, Tina. I will add this to the IPv6 Operations
>>>>>> agenda, probably
>>>>>>>> during our second session Tuesday.
>>>>>>>>
>>>>>>>> You will note that I am copying the chairs and ADs from several
>>>>>>>> working
>>>>>>>> groups. The reason is that the primary thrust of the
>>>>>> comments you are
>>>>>>>> making apply to work being done in those working groups.  
>>>>>>>> Slide 5
>>>>>>>> specifically requests a threat analysis, security assessment,  
>>>>>>>> and
>>>>>>>> "function recommendation" on each transition technology;
>>>>>> these are in
>>>>>>>> fact being done in behave and softwires. I mention 6man because
>>>>>>>> marketing blather from the IPv6 form makes security claims
>>>>>> for IPv6,
>>>>>>>> which it would be good if that working group clarified.
>>>>>>>>
>>>>>>>> I do have to ask specifically what the Security
>>>>>> Directorate hopes to
>>>>>>>> find in the three documents that have been requested for each  
>>>>>>>> of
>>>>>
>>>>>>>> these
>>>>>>>> various technologies. What, specifically, is a "function
>>>>>>>> recommendation"? A threat analysis is a statement that
>>>>>> there exist
>>>>>>>> a set
>>>>>>>> of possible threats. Is a security assessment a statement about
>>>>> how
>>>>>>>> those threats are responded to? What, if the WGs don't
>>>>>> produce it, is
>>>>>>>> going to leave the Security Directorate feeling ill-used?
>>>>>>>>
>>>>>>>> On Jul 27, 2009, at 12:56 PM, Tina TSOU wrote:
>>>>>>>>
>>>>>>>>>
>>>>>>>>> B. R.
>>>>>>>>> ">http://tinatsou.weebly.com/contact.html
>>>>>>>>
>>>>>>>>> Begin forwarded message:
>>>>>>>>>
>>>>>>>>>> From: "Romascanu, Dan (Dan)" <[e-mail]>
>>>>>>>>>> Date: July 27, 2009 7:52:20 AM GMT+02:00
>>>>>>>>>> To: Ron Bonica <[e-mail]>
>>>>>>>>>> Cc: Tina TSOU <[e-mail]>
>>>>>>>>>> Subject: FW: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>>>>>>
>>>>>>>>>> Ron,
>>>>>>>>>>
>>>>>>>>>> This looks more like an opsec (who are not meeting this
>>>>>> time) or
>>>>>>>>>> v6ops
>>>>>>>>>> subject.
>>>>>>>>>>
>>>>>>>>>> Dan
>>>>>>>>>>
>>>>>>>>>>
>>>>>>>>>> -----Original Message-----
>>>>>>>>>> From: Tina TSOU [mailto:[e-mail]]
>>>>>>>>>> Sent: Monday, July 27, 2009 12:02 AM
>>>>>>>>>> To: Romascanu, Dan (Dan)
>>>>>>>>>> Subject: Re: [OPS-DIR] Reminder: OPS-DIR working lunch
>>>>>>>>>>
>>>>>>>>>> Hi Dan,
>>>>>>>>>> Could this be discussed at OPS-DIR working lunch?
>>>>>>>>> <Recommendation of IPv6 Security work--on the flight-2.ppt>
>>>>>>>>> <ATT4180184.txt>
>>>>>>>>>
>>>>>>
>>>>>> _______________________________________________
>>>>>> secdir mailing list
>>>>>> [e-mail]
>>>>>> https://www.ietf.org/mailman/listinfo/secdir
>>>>>>
>>>>>
>>>>
>>>
>>
>