Subject: Re: [Full-disclosure] IPv6 security myths

From: Michael Richardson <[email-masked]>
Date: Mon, 01 Nov 2010 10:15:00 -0400

>>>>> "Masataka" == Masataka Ohta <[email-masked]> writes:
    Masataka> My context is IPsec in the Internet, which excludes VPNs.

    Masataka> Do you know some major application over the Internet using
    Masataka> IPsec with transport mode?

Why the restriction of *over*?
Dozens of IETF specifications are not used *over* the Internet, but only
over IP.  Recall that the IETF is about standardizing things over IP,
the internet is only a (large) subset of that.

iSCSI specifies IPsec in transport mode.
L2TP specifies IPsec in transport mode (but, that's remote-access, which
usually means VPNs, so you want exclude that).

So you are right: IPsec in transport mode is rarely used by popular
protocols.  But, it is out there, often being used to secure
applications that are one-offs, or whose use is not well known. 

That was the point of IPsec: It's a layer of security for people to use
rather than invent their own.

-- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition.

---

From: Masataka Ohta <[email-masked]>
Date: Tue, 02 Nov 2010 06:44:27 +0900

Michael Richardson wrote:

>>>>>> "Masataka" == Masataka Ohta<[email-masked]>  writes:
> over IP.

Because IPv6 and IPsec were designed for the Internet.

See, for example, RFC1825 saying:

   Widespread deployment and use of IP security will require an
   Internet-standard scalable key management protocol.

If it were possible to have a universal PKI over the Internet,
IPsec could have succeeded and IPv6 security myths could have
been real.

However, the reality is that there can be no such thing as
a universal PKI.

Note again that ICMPv6 messages were considered to be
authenticated by IPsec through the hypothetical universal PKI.

						Masataka Ohta