Subject: RE: [arch-d] Valid and Invalid Internet architectures and approaches

From: "Bound, Jim" <[email-masked]>
Date: Mon, 6 Mar 2006 08:05:11 -0500

Hi Brian, agree with you below 100%.

One point. And I am on board for SHIM6 as you and Eric N. know (but
still have SCTP bias but won't move on that unless Randy works on SHIM6
too I see no point without his support/help).

We are moving in deployment land for NGN to end-to-end security model
and most of the commercial Internet architects in enterprises (customers
with PHD's in Computer Science et al) I speak with agree and also the
security agency type folks in multiple geographies within multiple
governments that end-to-end securiity is a stronger model than current
model and that is longgggggggggggg discussion but just take me at face
value for now. Also wireless affects everything as you know.

As long as the edges do not have to look at the payload because it is
encrypted and can just forward the packet from the IP header then all is
ok, but if not that is still an issue regarding end-to-end for SHIM6?

Thoughts?

thanks
/jim 

> -----Original Message-----
> From: Brian E Carpenter [mailto:[email-masked]] 
> Sent: Monday, March 06, 2006 7:51 AM
> To: Tony Li
> Cc: [email-masked]
> Subject: Re: [arch-d] Valid and Invalid Internet 
> architectures and approaches
> 
> Oh Tony, you've woken me up ;-)
> 
> Tony Li wrote:
> > Thomas,
> > 
> > Architectural proposals have been lofted.  They were 
> specific, had clear
> > migration plans, and the discussion was shut down with the 
> usual "v6 has
> > already shipped" dogma.  Specific topics were:
> > 
> > 	- GSE (more generally locator/identifier splits)
> > 	- locator agile transport protocols
> > 
> > Without these types of capabilities, the architecture is stuck
> > supporting multihoming and mobility with kludges such as 
> NAT, SHIM6 (NAT
> > in the host), and various forms of tunneling.
> 
> I don't understand why you disparage SHIM6 (end-to-end 
> NAT-in-the-host)
> but don't disparage GSE (edge-to-edge NAT-in-the-router). It 
> was thinking
> about the end-to-end problems created by GSE that led directly to the
> conception of SHIM6. If one is a kludge, so is the other. 
> They both result
> in the upper layer protocol using a different "address" than 
> the routing
> system to identify a session. Viewed at an appropriate distance, they
> are isomorphic.
> 
> The common point is that by doing *and undoing* the NAT 
> action at both ends,
> the essential end-to-end properties of IP datagrams are not destroyed.
> Viewed at a slightly greater distance, they are both isomorphic with
> map-and-encap.
> 
> > 
> > To truly move forward, we first need to have consensus on 
> the following:
> > 
> > 	- We have a problem.
> 
> Which needs to be described with precision
> 
> > 	- The current crop of solutions are unsatisfactory.
> 
> Which needs to be justified.
> 
> > 	- We are willing to make changes.
> 
> Who's we? That's not intended flippantly - "we" would need to
> figure out in detail exactly who needs to be on board.
> 
>      Brian
> > 
> > Until then, we have the status quo.
> > 
> > Tony
> > 
> > _______________________________________________
> > Architecture-discuss mailing list
> > [email-masked]
> > https://www1.ietf.org/mailman/listinfo/architecture-discuss
> > 
> 
> 
> _______________________________________________
> Architecture-discuss mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/architecture-discuss
> 

_______________________________________________
Architecture-discuss mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/architecture-discuss

---

From: Brian E Carpenter <[email-masked]>
Date: Mon, 06 Mar 2006 14:47:16 +0100

Hi Jim,

> ok, but if not that is still an issue regarding end-to-end for SHIM6?

Unless they changed something since I stopped being active in shim6,
it really has no impact on IPSec - the addresses are flipped after
the crypto computation at the sender and before the crypto computation
at the receiver.

    Brian