Subject: [secdir] Discussion from the Security Directorate

From: Fred Baker <[email-masked]>
Date: Mon, 27 Jul 2009 13:36:57 +0200

Thanks, Tina. I will add this to the IPv6 Operations agenda, probably  
during our second session Tuesday.

You will note that I am copying the chairs and ADs from several  
working groups. The reason is that the primary thrust of the comments  
you are making apply to work being done in those working groups. Slide  
5 specifically requests a threat analysis, security assessment, and  
"function recommendation" on each transition technology; these are in  
fact being done in behave and softwires. I mention 6man because  
marketing blather from the IPv6 form makes security claims for IPv6,  
which it would be good if that working group clarified.

I do have to ask specifically what the Security Directorate hopes to  
find in the three documents that have been requested for each of these  
various technologies. What, specifically, is a "function  
recommendation"? A threat analysis is a statement that there exist a  
set of possible threats. Is a security assessment a statement about  
how those threats are responded to? What, if the WGs don't produce it,  
is going to leave the Security Directorate feeling ill-used?

On Jul 27, 2009, at 12:56 PM, Tina TSOU wrote:

>
> B. R.
> ">http://tinatsou.weebly.com/contact.html

> Begin forwarded message:
>
>> From: "Romascanu, Dan (Dan)" <[email-masked]>
>> Date: July 27, 2009 7:52:20 AM GMT+02:00
>> To: Ron Bonica <[email-masked]>
>> Cc: Tina TSOU <[email-masked]>
>> Subject: FW: [OPS-DIR] Reminder: OPS-DIR working lunch
>>
>> Ron,
>>
>> This looks more like an opsec (who are not meeting this time) or  
>> v6ops
>> subject.
>>
>> Dan
>>
>>
>> -----Original Message-----
>> From: Tina TSOU [mailto:[email-masked]]
>> Sent: Monday, July 27, 2009 12:02 AM
>> To: Romascanu, Dan (Dan)
>> Subject: Re: [OPS-DIR] Reminder: OPS-DIR working lunch
>>
>> Hi Dan,
>> Could this be discussed at OPS-DIR working lunch?
> <Recommendation of IPv6 Security work--on the flight-2.ppt>
> <ATT4180184.txt>
>

---

From: Joel Jaeggli <[email-masked]>
Date: Mon, 27 Jul 2009 14:08:12 +0200

I'd probably tune the slides a bit still:

	Security problems show up in deployment and use, these cannot be
	thought out at all when designing the protocols

Is an assertion you'll get pushback on. we have signficant operational
experience with variations on many of the proposed or deployed
transition mechanisms. necessarily that experience informs both our
current thinking and the desirability of any particular approach.

bump in the wire type transition technologies certainly are an area
potential concern for opsec

Fred Baker wrote:
> You will note that I am copying the chairs and ADs from several working
> groups. The reason is that the primary thrust of the comments you are
> making apply to work being done in those working groups. Slide 5
> specifically requests a threat analysis, security assessment, and
> recommendation"? A threat analysis is a statement that there exist a set
> of possible threats. Is a security assessment a statement about how
> those threats are responded to? What, if the WGs don't produce it, is
> going to leave the Security Directorate feeling ill-used?
> 
>>> This looks more like an opsec (who are not meeting this time) or v6ops
>>> subject.
>>>
>>> Dan
>>>
>>>

---

From: Fred Baker <[email-masked]>
Date: Tue, 28 Jul 2009 22:49:11 +0200

I'm not arguing against the request. I'm asking what it is requesting,  
as I have no idea...

I think I know what a threat analysis is.

What is a "security assessment" apart from a "threat assessment"? I  
told v6ops (which does not develop transition technologies, by  
charter, and therefore is the absolute wrong place to send this) that  
I thought it might mean an assessment of how we might mitigate the  
threats. Absent any answers from the Security Directorate responsive  
to the question, I have no idea whether I was correct.

And what on God's Green Earth is a "function recommendation"? I have  
no idea what you want.

Nobody from the Security Directorate was there today to deliver the  
message. If I were developing a threat assessment of that protocol...  
let's see: delivered to the wrong WG by someone who didn't know what  
the message was supposed to be using slides he didn't understand and  
the security directorate didn't take the time to explain...

On Jul 27, 2009, at 2:08 PM, Joel Jaeggli wrote:

>> working

---

From: Joel Jaeggli <[email-masked]>
Date: Wed, 29 Jul 2009 10:55:13 +0200

Fred Baker wrote:
> What is a "security assessment" apart from a "threat assessment"? I told
> v6ops (which does not develop transition technologies, by charter, and
> therefore is the absolute wrong place to send this) that I thought it
> might mean an assessment of how we might mitigate the threats. Absent
> any answers from the Security Directorate responsive to the question, I
> have no idea whether I was correct.

I don't get the warm fuzzy impression that what the security directorate
 was attempting to communicate was conveyed.

If the cpe security discussion in v6 ops underscores anything it's the
compromise that we arrived at in ipv4 with 30 years worth of
intellectual ferment where desirable or un, is quite hard to arrive at
by deliberate intention.

> And what on God's Green Earth is a "function recommendation"? I have no
> idea what you want.
> 
> let's see: delivered to the wrong WG by someone who didn't know what the
> message was supposed to be using slides he didn't understand and the
> security directorate didn't take the time to explain...
>

---

From: "David Harrington" <[email-masked]>
Date: Wed, 29 Jul 2009 11:30:07 +0200

Hi,

I have a question. 
I am a member of the Security Directorate, and I do not remember any
discussion leading to this powerpoint presentation or request. I may
have missed a SECDIR session. I didn't find discussion of this
powerpoint presentation in the secdir archives prior to this week. 

Is this a "Discussion from the Security Directorate"? If so, when was
this discussed? Has the SECDIR reviewed this powerpoint slide deck and
approved it being sent to working groups?

David Harrington
[email-masked]
[email-masked]
[email-masked]

> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Fred Baker
> Sent: Tuesday, July 28, 2009 10:49 PM
> To: Joel Jaeggli
> Cc: 6man Chairs; [email-masked]; [email-masked]; 
> Kurt Erik Lindqvist; Joe Abley; Softwire Chairs; 
> [email-masked]; [email-masked]; Tina 
> TSOU; [email-masked]; Behave Chairs
> Subject: Re: [secdir] Discussion from the Security Directorate
> 

> >> find in the three documents that have been requested for each of

> >> these
> >> recommendation"? A threat analysis is a statement that 
> there exist  
> >> a set
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
>

---

From: Fred Baker <[email-masked]>
Date: Wed, 29 Jul 2009 17:04:53 +0200

It was presented to the ops directorate as "from the security  
directorate" on Monday, and shipped off to my working group.

OK, Tina, over to you...

---

From: Richard Barnes <[email-masked]>
Date: Wed, 29 Jul 2009 17:23:18 +0200

I'll second Dave, I don't remember seeing this in a SECDIR context 
before Fred sent it around.

---

From: Tina <[email-masked]>
Date: Wed, 29 Jul 2009 17:23:53 +0200

Hi Fred and David,
The slides were sent to OPS ADs, and we discussed it a bit in OPS-DIR  
work lunch on Monday. According to the suggestion from Dan, I  
forwarded the slides to the WG chairs of v6ops and opsec.

Then Fred forwarded to SEC-DIR.

I mentioned Fred's email during SEC-DIR work lunch on Tuesday. There  
was discussion.

I went to Tuesday v6ops session before my slides were taken. Then I  
left for some personal emergency reasons. Therefore I was not able to  
present the slides. But Fred did it.

The slides will be presented in OPS Area Opening meeting in the Large  
Stage between 15:10 to 16:10.

B. R.
Tina
http://tinatsou.weebly.com/contact.html

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Wed, 29 Jul 2009 11:55:44 -0400

--On Wednesday, July 29, 2009 05:23:53 PM +0200 Tina <[email-masked]> 
wrote:

> work lunch on Monday. According to the suggestion from Dan, I forwarded
> the slides to the WG chairs of v6ops and opsec.

Who sent them to the OPS AD's?  This is the first I've heard of this, and 
certainly others on the security directorate seem to be in the same boat. 
Some context would be nice...

-- Jeff

---

From: Tina TSOU <[email-masked]>
Date: Thu, 30 Jul 2009 12:19:30 +0200

On Jul 29, 2009, at 5:55 PM, Jeffrey Hutzelman wrote:

> --On Wednesday, July 29, 2009 05:23:53 PM +0200 Tina  
> <[email-masked]> wrote:
>
>> Hi Fred and David,
>> forwarded
> Who sent them to the OPS AD's?  This is the first I've heard of  
> this, and certainly others on the security directorate seem to be in  
> the same boat. Some context would be nice...
>
> -- Jeff
>
I sent the slides to OPS AD's. In the first email Fred send to you  
about this subject, you could see the email history.

Tina

---

From: Fred Baker <[email-masked]>
Date: Thu, 30 Jul 2009 13:49:42 +0200

On Jul 30, 2009, at 10:41 AM, David Harrington wrote:

> I think the real clarification that needs to be made is that this is
> NOT a communication from the Security Directorate. It is a discussion
> from Tina.

I apologize for my confusion. I expedited it on my agenda due to my  
understanding that it was a formal request. Especially given that it  
will be discussed this afternoon in a meeting that the folks that Tina  
would like to do the work will not be in, I suspect this needs some  
further thought.

---

From: Fred Baker <[email-masked]>
Date: Thu, 30 Jul 2009 13:56:50 +0200

who is "we"?

I would suggest that you make your request to the chairs of the  
various working groups doing the work. These include 6man (designated  
custodian of all things IPv6 and therefore of RFCs 3053, 3056, 4213,  
and 5214), behave (translation), and softwire (tunnels).

On Jul 29, 2009, at 8:45 PM, Tina wrote:

> Hi again:)
> Some clarifications for the slides.
>
> a. security assessment, to evaluate the security of a transition  
> technology. What aspects do we need to judge and consider?
> b. function recommendation, to reduce the security threat of some  
> kind of transition technology. When deploy this technology, what  
> functionalities should the device need to have?
>
>
> B. R.
> Tina
> On Jul 29, 2009, at 5:23 PM, Tina wrote:
>
>> Hi Fred and David,
>> The slides were sent to OPS ADs, and we discussed it a bit in OPS- 
>> DIR work lunch on Monday. According to the suggestion from Dan, I  
>> I mentioned Fred's email during SEC-DIR work lunch on Tuesday.  
>> There was discussion.
>>
>> left for some personal emergency reasons. Therefore I was not able  
>> to present the slides. But Fred did it.
>>
>> The slides will be presented in OPS Area Opening meeting in the  
>> Large Stage between 15:10 to 16:10.
>>
>>
>> B. R.
>> Tina

---

From: Fred Baker <[email-masked]>
Date: Thu, 30 Jul 2009 14:02:58 +0200

additional drafts:

http://tools.ietf.org/html/draft-despres-6rd
   "IPv6 Rapid Deployment on IPv4 infrastructures (6rd)", Remi Despres,
   7-Apr-09, <draft-despres-6rd-03.txt>

http://tools.ietf.org/html/draft-despres-sam
   "Scalable Multihoming across IPv6 Local-Address Routing Zones
   Global-Prefix/Local-Address Stateless Address Mapping (SAM)", Remi  
Despres,
   13-Jul-09, <draft-despres-sam-03.txt>

http://tools.ietf.org/html/draft-despres-6rd
   "IPv6 Rapid Deployment on IPv4 infrastructures (6rd)", Remi Despres,
   7-Apr-09, <draft-despres-6rd-03.txt>

http://tools.ietf.org/html/draft-despres-sam
   "Scalable Multihoming across IPv6 Local-Address Routing Zones
   Global-Prefix/Local-Address Stateless Address Mapping (SAM)", Remi  
Despres,
   13-Jul-09, <draft-despres-sam-03.txt>

http://tools.ietf.org/html/draft-denis-behave-v4v6exthdr
   "IPv6 destination header option for IPv4 translator mapping  
notification",
   Remi Denis-Courmont, 9-Mar-09, <draft-denis-behave-v4v6exthdr-01.txt>

http://tools.ietf.org/html/draft-ietf-behave-v6v4-framework
   "Framework for IPv4/IPv6 Translation", Fred Baker, Xing Li,  
Congxiao Bao,
   Kevin Yin, 6-Jul-09, <draft-ietf-behave-v6v4-framework-00.txt>

http://tools.ietf.org/html/draft-ietf-behave-v6v4-xlate
   "IP/ICMP Translation Algorithm", Xing Li, Congxiao Bao, Fred Baker,
   26-Jun-09, <draft-ietf-behave-v6v4-xlate-00.txt>

http://tools.ietf.org/html/draft-ietf-behave-v6v4-xlate-stateful
   "NAT64: Network Address and Protocol Translation from IPv6 Clients  
to IPv4
   Servers", Marcelo Bagnulo, Philip Matthews, Iljitsch van Beijnum,  
11-Jul-09,
   <draft-ietf-behave-v6v4-xlate-stateful-01.txt>

http://tools.ietf.org/html/draft-ietf-behave-dns64
   "DNS64: DNS extensions for Network Address Translation from IPv6  
Clients to
   IPv4 Servers", Marcelo Bagnulo, Andrew Sullivan, Philip Matthews,  
Iljitsch
   van Beijnum, 4-Jul-09, <draft-ietf-behave-dns64-00.txt>

http://tools.ietf.org/html/draft-xli-behave-ivi
   "The CERNET IVI Translation Design and Deployment for the IPv4/IPv6
   Coexistence and Transition", Xing Li, Congxiao Bao, Maoke Chen,  
Hong Zhang,
   Jianping Wu, 13-Jun-09, <draft-xli-behave-ivi-02.txt>

http://tools.ietf.org/html/draft-wu-softwire-4over6
   "4over6 Transit Solution using IP Encapsulation and MP-BGP  
Extensions",
   Jianping Wu, Yong Cui, Xing Li, Mingwei Xu, Chris Metz, 14-Apr-09,
   <draft-wu-softwire-4over6-02.txt>

On Jul 30, 2009, at 1:56 PM, Fred Baker wrote:

> various working groups doing the work. These include 6man  
> (designated custodian of all things IPv6 and therefore of RFCs 3053,  
> 3056, 4213, and 5214), behave (translation), and softwire (tunnels).
>
>>> I went to Tuesday v6ops session before my slides were taken. Then  
>>> I left for some personal emergency reasons. Therefore I was not  
>>> able to present the slides. But Fred did it.
>>>