# Presentation: 577537

## USG IPv6 Profile:Components and Timing

- Doug Montgomery
- (dougm@nist.gov)

## History / Context

**OMB - Policy M-05-22 & FAQ**
- _[http://www.whitehouse.gov/omb/memoranda/fy2005/m05-22.pdf](http://www.whitehouse.gov/omb/memoranda/fy2005/m05-22.pdf)_
- _[http://www.whitehouse.gov/omb/egov/documents/IPv6_FAQs.pdf](http://www.whitehouse.gov/omb/egov/documents/IPv6_FAQs.pdf)_
**All Agencies** – Plan for IPv6 adoption.  Deploy & use “IPv6 capable/compliant” products in “core” networks by June 2008.
- Requires agencies to “ensure orderly and secure transition”
- FAQ: “Agencies should verify ...capability through testing ...are required to maintain security during and after adoption ...”
**NIST** – “The National Institute for Standards and Technology (NIST) will develop, as necessary, a standard to address IPv6 compliance for the Federal government.”
**OMB & GSA** – “Additionally, as necessary, the General Services Administration and the Federal Acquisition Regulation Council will develop a suitable FAR amendment for use by all agencies.”
**NIST Activities**
- Surveyed the state of industry, DoD, and foreign profile and testing efforts.
- Met with DoD, JITC, IPv6Forum, UNH/IOL, TAHI, ETSI, INRISA, USG IPv6 Working Group,  Large users and vendor.
- Recommended a path of development of USG IPv6 Profile/Test program
- and explicit goal of fostering harmonization across industry/user groups and planning for USG exit as soon as prudent.

## DRAFT2 USGIPv6-V1.0http://www.antd.nist.gov/usgv6/

**Status / Plans**
- Draft2 circulated for public comment 2008-01-23.
- Comment period closes Feb 29th.
- See URL above for information.
- Draft2 – significant changes ...
- Resolved  ~500 comments from ~50 sources on Draft1.
- Harmonized with existing/emerging profiles.
- Made explicit recommendations for profile lifecycle,  timing and compliance issues.
- Outlined the plans for compliance
- Definition,  timing, testing, documentation.

## USGIPv6-V1 Overview

**Scope and Application**
**Recommendation from NIST** – in isolation is **policy free**.
- Applicable to “non national security Federal IT systems”.
**Strategic planning document to guide acquisition **of IPv6 technologies for operational Federal IT systems.
- Other uses/time-frames are cautioned.
- Defines useful **sets of IPv6 requirements **to:
- Deliver expected functionality
- Insure interoperability
- Enable secure operation
- Protect early investments
- Defines and **compliance framework **to:
- Enable products to be tested against requirement sets.
- Document the results of such tests.
**Technical basis **for further refinement and other uses:
- Agency / mission specific technical requirements.
- Everything that is not mentioned is optional.
- Agency / USG acquisition / deployment policies.

## What the Profile is Not

- Applicable in the very near term
- Not relevant to June 2008 requirements.
- No mandatory requirement should be expected sooner than 24 months after “indication” and 12 months after final “MUST” is published.
- Deployment or Operations Guide
- Designed to be a guide to acquisition.
- Significant additional planning, guidance, reference will be needed to develop operational usage plans and policies.
- Static, Complete, Universally Applicable
- It is fully expected that users will modify with agency, mission, procurement specific requirements.  **In fact it is required.**
- That some devices, systems, uses will not be easily accommodated by the generalizations of the profile.

## “Device” Requirements

- IPv6 Requirements
- Organized into subsets by “device” type
- Host, router, network protection device (NPD).
- Organized by functionality
- Base, Mobility, Routing, QoS, Transition, Link, Security, Multicast, Application, NPDs
- Organized by normativity
- Unconditional MUSTs
- Conditional MUSTs
- Optional Capabilities
- SHOULD+
- SHOULD, SHOULD-,

| USGv6-V1 Host Requirements:
[M] – IPv6 Basic Requirements – see section 6.1.
[O:1] – SLAAC – require support of stateless address auto-configuration.
[O:1] – DHCP-Client – require support of stateful (DHCP) address auto-configuration. 
[Y/N] – PrivAddr – require support of SLAAC privacy extensions.
[Y/N] – SEND – require support of neighbor discovery security extensions.
[M] – Addressing Requirements – see section 6.6.
[Y/N] – CGA – require support of cryptographically generated addresses.
[O] – Application Requirements – see section 6.11.
[Y/N] – DNS-Client – require support of DNS client/resolver functions.
[Y/N] – Sock – require support of Socket application program interfaces.
[Y/N] – URI – require support of IPv6 uniform resource identifiers.
[Y/N] – DNS-Server – require support of a DNS server application.
[Y/N] – DHCP-Server – require support of a DHCP server application.
[M] – IP Security Requirements – see section 6.7.
[M] – IPsec-V3 – require support of the IP security architecture.
[M] – IKEv2 – require support for automated key management.
[M] – ESP – require support for encapsulating security payloads in IP.
[O] – Transition Mechanism Requirements – see section 6.4.
[Y/N] – IPv4 – require support to enable interoperation with IPv4-only systems.
[O] – Network Management Requirements – see section 6.8.
[Y/N] – SNMP – require support of network management services.
[M] – Multicast Requirements – see section 6.9.
[Y/N] – SSM – require full support of multicast communications.
[O] – Mobility Requirements – see section 6.10.
 [Y/N] – MIP – require support of capability for this host to be a mobile node.
[O] – Quality of Service Requirements – see section 6.3.
[Y/N] – DS – require support of Differentiated Services capabilities.
[M] – Link Specific Technologies – see section 6.5.
[O:1] – Link – require support of 1 or more link technologies.
[Y/N] – ROHC – require support of robust packet compression services. |
| --- |

-   Requirement Articulation
-  Users must choose among configuration options.

## Router / NPD Requirements

**Router**

**Network Protection Device**

| USGv6-V1 Router Requirements:
[M] – IPv6 Basic Requirements – see section 6.1.
 [Y/N] – DHCP-Prefix – require support of automated router prefix delegation. 
 [Y/N] – SEND – require support of neighbor discovery security extensions.
[M] – Addressing Requirements – see section 6.6.
[Y/N] – CGA – require support of cryptographically generated addresses.
[O] – Application Requirements – see section 6.11.
[Y/N] – DNS-Client – require support of DNS client/resolver functions.
[Y/N] – URI – require support of IPv6 uniform resource identifiers.
[Y/N] – DNS-Server – require support of a DNS server application.
[Y/N] – DHCP-Server – require support of a DHCP server application.
[M] – Routing Protocol Requirements – see section 6.2.
[O:1] – IGW – require support of the intra-domain (interior) routing protocols.
[O:1] – EGW – require support for inter-domain (exterior) routing protocols.
 [M] – IP Security Requirements – see section 6.7.
[M] – IPsec-V3 – require support of the IP security architecture.
[M] – IKEv2 – require support for automated key management.
[M] – ESP – require support for encapsulating security payloads in IP.
[O] – Transition Mechanism Requirements – see section 6.4.
[Y/N] – IPv4 – require support to enable interoperation with IPv4-only systems.
[Y/N] – 6PE – require support of tunneling IPv6 over IPv4 MPLS services.
[M] – Network Management Requirements – see section 6.8.
[M] – SNMP – require support of network management services.
[M] – Multicast Requirements – see section 6.9.
[Y/N] – SSM – require full support of multicast routing services. 
[O] – Mobility Requirements – see section 6.10.
 [Y/N] – MIP – require support of mobile IP home agent capabilities.
[Y/N] – NEMO – require support of mobile network capabilities.
[M] – Quality of Service Requirements – see section 6.3.
[M] – DS – require support of Differentiated Services capabilities.
[M] – Link Specific Technologies – see section 6.5.
[O:1] – Link – require support of 1 or more link technologies.
[Y/N] – ROHC – require support of robust packet compression services. |
| --- |

| USGv6-V1 NPD Requirements:
[M] – Network Protection Device Requirements – see section 6.12.
[O:1] – FW – require support of basic firewall capabilities. 
[O:1] – APFW – require support of application firewall capabilities.
[O:1] – IDS – require support of intrusion detection capabilities. |
| --- |

## Requirements Definitions

- Node Requirements Table
- Normative definition of requirements sets.
- Conditions / Contexts
- Identify requirements predicated upon situation / selection.
- Fully articulated specification of requirements
- Selection among configuration options
- Notations
- “USGv6-V1-Capable” – the set of requirements that are unconditional MUSTs.
- 9 hosts compliant to: USGv6-V1-Capable+DHCP-client+Sock+DNS-Client+Link=Ethernet
- 3 hosts compliant to: USGv6-V1-Capable+SLAAC+Sock+DNS-Client+MIP+Link=PPP+Link=Ethernet

| Condition | Router | Meaning |
| --- | --- | --- |
| DHCP-Prefix | c(M,S+) | If the configuration option DHCP-Prefix is selected then the requirement level is “M”, otherwise it is “S+”. |
| EGW or 6PE | c(M) | If either the EGW or 6PE configuration option is selected, the requirement level is “M”, otherwise “O”. |

## Example

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | Multicast Requirements |   |   |   |   |   |   |   |
| RFC3810 |   | MLD Version 2 for IPv6 | PS | 2004 |   | M | M |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
| RFC4607 |   | Source-Specific Multicast for IP | PS | 2006 | SSM | c(M) | c(M) |   | 2010/03 |
| RFC4604 |   | MLDv2 for Source Specifice Multicast (SSM) | PS | 2006 | SSM | c(M) | c(M) |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Protocol Indepdendent Multicast (PIM) |   |   |   |   |   |   |   |
| RFC4601 |   | PIM Sparse Mode (SM) | PS | 2006 | SSM |   | c(S+) |   |   |
| RFC4609 |   | PIM-SM  Security Issues / Enhancements | INF | 2006 | SSS |   | c(S) |   |   |
| RFC3956 |   | Embedding Rendezvous Point (RP)  Mcast Addr | PS | 2004 | SSM |   | c(S+) |   |   |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Mobility Requirements |   |   |   |   |   |   |   |
| RFC3775 |   | Mobility Support in IPv6 | PS | 2004 | MIP | c(M) | c(M) |   | 2010/03 |
|   | 8.1 | All Nodes as Correspondent Node |   |   | MIP | M |   |   | 2010/03 |
|   | 8.2 | Route Optimization |   |   | MIP | c(M) |   |   | 2010/03 |
|   | 8.2 | Allow route optimization to be  disabled. |   |   | MIP | c(M) |   |   | 2010/03 |
|   | 8.3 | All IPv6 Routers |   |   | MIP |   | M |   | 2010/03 |
|   | 8.4 | Home Agents |   |   | MIP |   | c(M) |   | 2010/03 |
|   | 8.5 | Mobile Nodes |   |   | MIP | c(M) |   |   | 2010/03 |
| RFC4282 |   | The Network Access Identifier | PS | 2005 | MIP | c(S+) |  c(S+) |   |   |
| RFC4283 |   | Mobile Node Identifier option for MIPV6 | PS | 2005 | MIP | c(S+) | c(S+) |   |   |
| RFC4877 |   | MIPv6 Operation with IKEv2 and IPsec-v3 | PS | 2004 | MIP | c(M) | c(M) |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
| RFC3963 |   | Network Mobility (NEMO) Basic Support | PS | 2005 | NEMO |   | c(M) |   | 2010/03 |

## Profile Life Cycles

**Evolution**
- Profiles, products and tests will continuously evolve.
- Each needs time to react to the changes in the others.
- Enabling and adapting to such evolution will be critical to success.
**Profile Evolution**
- USGv6 Profile to be published yearly, as necessary.
- In general, industry should be given 24 months to react to the “indication” of any new requirement.
- MUST requirements of profile to be operative 12 months after final publication.
- SHOULD+ shall be considered as the “indication” of a future requirement.
- Thus time from “SHOULD+” to operative “MUST” will be two publication cycles, or at least 24 months.
**V1 Boot Strap**
- Given that there is no previous version, we allow 24 months before V1 MUSTs are operative.

## USGv6-V1 Node Requirements Table

## Slide 12

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | IPv6 Basic  Requirements |   |   |   |   |   |   |   |
| RFC2460 |   | IPv6 Specification | DS | 1998 |   | M | M |   | 2010/03 |
|   | 2 | IPv6 Packets: send, receive |   |   |   | M | M |   | 2010/03 |
|   | 2 | IPv6 packet forwarding |   |   |   |   | M |   | 2010/03 |
|   | 4 | Extension headers: processing |   |   |   | M | M |   | 2010/03 |
|   | 4.3 | Hop-by-Hop & unrecognized options |   |   |   | M | M |   | 2010/03 |
|   | 4.5 | Fragment headers: send, receive, process |   |   |   | M | M |   | 2010/03 |
|   | 4.6 | Destination Options extensions |   |   |   | M | M |   | 2010/03 |
| RFC5095 |   | Deprecation of Type 0 Routing Headers | PS | 2007 |   | M | M |   | 2010/03 |
| RFC2711 |   | IPv6 Router Alert Option | PS | 1999 |   |   | M |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
| RFC4443 |   | ICMPv6 | DS | 2006 |   | M | M |   | 2010/03 |
| RFC4884 |   | Extended ICMP for Multi-Part Messages | PS | 2007 |   | S+ | S+ |   |   |
|   |   |   |   |   |   |   |   |   |   |
| RFC1981 |   | Path MTU Discovery for IPv6 | DS | 1996 |   | M | M |   | 2010/03 |
|   | 4 | Discovery Protocol Requirements |   |   |   | M | M |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
| RFC2675 |   | IPv6 Jumbograms | PS | 1999 |   | O | O |   |   |
|   |   |   |   |   |   |   |   |   |   |
| RFC4861 |   | Neighbor Discovery for IPv6 | DS | 2006 |   | M | M |   | 2010/03 |
|   | 4.1, 4.2 | Router Discovery |   |   |   | M | M |   | 2010/03 |
|   | 4.6.2 | Prefix Discovery |   |   |   | M | M |   | 2010/03 |
|   | 7.2 | Address Resolution |   |   |   | M | M |   | 2010/03 |
|   | 7.2.5 | NA and NS processing |   |   |   | M | M |   | 2010/03 |
| (RFC4862) | 7.2.3 | Duplicate Address Detection |   |   |   | M | M |   | 2010/03 |
|   | 7.3 | Neighbour Unreachability Detection |   |   |   | M | M |   | 2010/03 |
|   | 8 | Redirect functionality |   |   |   | S | M |   | 2010/03 |
| RFC5075 |   | IPv6 Router Advertisement Flags Option | PS | 2007 |   | S+ | S+ |   |   |
| RFC4191 |   | Default Router Preference  | PS | 2005 |   | S+ | S+ |   |   |
|   |   |   |   |   |   |   |   |   |   |
| RFC3971 |   | Secure Neighbour Discovery | PS | 2005 | SEND | c(M) | c(M) |   |   |

## Slide 13

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | Auto Configuration |   |   |   |   |   |   |   |
| RFC4862 |   | IPv6 Stateless Address Autoconfig | DS | 2007 | SLAAC | c(M) |   |   | 2010/03 |
|   | 5.3 | Creation of Link Local Addresses |   |   | SLAAC | M | M |   | 2010/03 |
| (RFC4861) | 5.4 | Duplicate Address Detection |   |   | SLAAC | M | M |   | 2010/03 |
|   | 5.5 | Creation of Global Addresses |   |   | SLAAC | c(M) |   |   | 2010/03 |
|   | * | Ability to Disable  Creation of Global Addrs |   |   | SLAAC | c(M) |   |   | 2010/03 |
| RFC4941 |   | Privacy Extensions for IPv6 SLAAC | PS | 2001 | SLAAC & PriAddr | c(M) |   |   |   |
|   |   | MIP Mobile Node |   |   | SLAAC & MIP | c(S+) |   |   |   |
|   |   |   |   |   |   |   |   |   |   |
| RFC3736 |   | Stateless DHCP Service for IPv6 | PS | 2004 | SLAAC | c(S+) |   |   |   |
|   |   |   |   |   |   |   |   |   |   |
| RFC3315 |   | Dynamic Host Config Protocol (DHCPv6) | PS | 2003 | DHCP-Client | c(M) |   |   | 2010/03 |
|   | * | Ability to Administratively Disable |   |   | DHCP-Client | c(M) |   |   | 2010/03 |
|   |   | DHCP Client Functions |   |   | DHCP-Client | c(M) |   |   | 2010/03 |
| RFC4361 |   | Node-specific Client Identifiers for DHCPv4 | PS | 2006 | DHCP-Client           & IPv4 | c(S+) |   |   |   |
| RFC3633 |   | Prefix Delegation | PS | 2003 | DHCP-Prefix |   | c(M,S+) |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Addressing Requirements |   |   |   |   |   |   |   |
| RFC4291 |   | IPv6 Addressing Architecture | DS | 2006 |   | M | M |   | 2010/03 |
| RFC4007 |   | IPv6 Scoped Address Architecture | PS | 2005 |   | M | M |   | 2010/03 |
|   | * | Ability to manually configure Addresses |   |   |   | M | M |   | 2010/03 |
| RFC4193 |   | Unique Local IPv6 Unicast Address | PS | 2005 |   | M | M |   | 2010/03 |
| RFC3879 |   | Deprecating Site Local Addresses | PS | 2004 |   | M | M |   | 2010/03 |
| RFC3484 |   | Default Address Selection for IPv6 | PS | 2003 |   | M | M |   | 2010/03 |
|   | 2.1 | Configurable Selection Policies |   |   |   | S+ | S+ |   |   |
| RFC2526 |   | Reserved IPv6 Subnet Anycast Addresses | PS | 1999 |   | M | M |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
| RFC3972 |   | Cryptographically Generated Addresses | PS | 2005 | SEND or CGA | c(M) | c(M) |   | 2010/03 |
| RFC4581 |   | (CGA) Extension Field Format | PS | 2006 | SEND or CGA | c(M) | c(M) |   | 2010/03 |
| RFC4982 |   | (CGA) Support for Multiple Hash Algos. | PS | 2007 | SEND or CGA | c(M) | c(M) |   | 2010/03 |

## Slide 14

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | Application Requirements |   |   |   |   |   |   |   |
| RFC3596 |   | DNS Extensions for IPv6 | DS | 2003 | DNS-Client | c(M) | c(M) |   | 2010/03 |
|   | 2.1 | Support of AAAA records |   |   | DNS-Client | c(M) | c(M) |   | 2010/03 |
|   | 2.5 | Support of ipv6.arpa PTR records |   |   | DNS-Client | c(M) | c(M) |   | 2010/03 |
| RFC2671 |   | Extenstion Mechanisms for DNS (EDNS0) | PS | 199 | DNS-Client | c(M) | c(M) |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
| RFC3986 |   | URI: Generic Syntax | S-66 | 2005 | URI | c(M) | c(M) |   | 2010/03 |
| RFC3493 |   | Basic Socket API for IPv6 | INF | 2003 | SOCK | c(M) |   |   | 2010/03 |
| RFC3542 |   | Advanced Socket API for IPv6 | INF | 2003 | SOCK | c(M) |   |   | 2010/03 |
| RFC4584 |   | Extension to Sockets API for Mobile IPv6 | INF | 2006 | SOCK & MIP | c(M) |   |   | 2010/03 |
| RFC3678 |   | Socket  API Extensions Multicast Source Filters | INF | 2004 | SOCK & SSM | c(M) |   |   | 2010/03 |
| RFC5014 |   | Socket API for Source Address Selection | ING | 2007 | SOCK | c(S+) |   |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Specific Applications |   |   |   |   |   |   |   |
| RFC3596 |   | DNS Server | DS | 2003 | DNS-Server | c(M) | c(M) |   |   |
| RFC3315 |   | DHCPv6 Server | PS | 2003 | DHCP-Server | c(M) | c(M) |   |   |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Routing Protocol Requirements |   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Interior Routing Protocol |   |   |   |   |   |   |   |
| RFC2740 |   | OSPF for IPv6 | PS | 1999 | IGW |   | c(M) |   | 2010/03 |
| RFC4552  |   | Authentication/Confidentiality for OSPFv3 | PS | 2006 | IGW |   | c(M) |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Exterior Routing Protocol |   |   |   |   |   |   |   |
| RFC4271 |   | Border Gateway Protocol 4 (BGP-4) | DS | 2006 | EGW or 6PE |   | c(M) |   | 2010/03 |
| RFC1772 |   | BGP Application in the Internet | DS | 1995 | EGW or 6PE |   | c(M) |   | 2010/03 |
| RFC4760 |   | BGP Multi-Protocol Extensions | DS | 2007 | EGW or 6PE |   | c(M) |   | 2010/03 |
| RFC2545 |   | BGP Multi-Protocol Extensions for IPv6 IDR | PS | 1999 | EGW or 6PE |   | c(M) |   | 2010/03 |

## Slide 15

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | IP Security Requirements |   |   |   |   |   |   |   |
|   |   |   |   |   |   |   |   |   |   |
|   |   | IPsec-v3 |   |   |   |   |   |   |   |
| RFC4301 |   | Security Architecture for the IP | PS | 2005 |   | M | M |   | 2010/03 |
|   | 4.1 | Support of Transport Mode SAs |   |   | IPv4 | M | c(M) |   | 2010/03 |
|   | 4.5.1 | Manual SA and Key Management |   |   |   | M | M |   | 2010/03 |
|   | 4.5.2 | Automated SA and Key Management |   |   |   | M | M |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
| RFC4303 |   | Encapsulating Security Payload (ESP) | PS | 2005 | IPsec-v3 | M | M |   | 2010/03 |
| RFC4302 |   | Authentication Header (AH) | PS | 2005 | IPsec-v3 | O | O |   |   |
| RFC3948 |   | UDP Encapsulation of ESP Packets | PS | 2005 | IPsec-v3 | O | O |   |   |
| RFC4835 |   | Cryptographic Algorithms for ESP and AH | PS | 2005 | IPsec-v3 | M | M |   | 2010/03 |
|   | * | (See additional 4835 requirements below) |   |   |   |   |   |   |   |
| RFC4308 |   | Cryptographic Suites for IPsec | PS | 2005 | IPsec-v3 | O | O |   |   |
|   | 2.1 | VPN-A |   |   | IPsec-v3 | S | S |   |   |
|   | 2.2 | VPN-B |   |   | IPsec-v3 | S+ | S+ |   |   |
| RFC4809 |   | Requirements for an IPsec Cert Mgmnt Profile | PS | 2007 | IPsec-v3 | S+ | S+ |   |   |
|   |   |   |   |   |   |   |   |   |   |
|   |   | IKEv2 |   |   |   |   |   |   |   |
| RFC4306 |   | Internet Key Exchange (IKEv2) Protocol | PS | 2005 | IKEv2 | M | M |   | 2010/03 |
|   | 4 | Pre-shared secrets |   |   | IKEv2 | M | M |   | 2010/03 |
|   | 4 | RSA sig auth |   |   | IKEv2 | M | M |   | 2010/03 |
|   | 4 | NAT-T in IKEv2 |   |   | IKEv2 | O | O |   |   |
|   | 3.3.3 | ESN |   |   | IKEv2 | M | M |   | 2010/03 |
| RFC4307 |   | Cryptographic Algorithms for IKEv2 | PS | 2005 | IKEv2 | M | M |   | 2010/03 |
|   | 3.1.2 | Diffie-Hellman MODP group 2  |   |   | IKEv2 | M | M |   | 2010/03 |
|   | 3.1.2 | Diffie-Hellman MODP group 14  |   |   | IKEv2 | S+ | S+ |   |   |
|   |   |   |   |   |   |   |   |   |   |
| RFC3526 |   | More MODP DH Groups for IKE | PS | 2003 | IKEv2 | S | S |   |   |
| RFC4945 |   | Internet IPsec PKI Prifle of IKEv1, IKEv2 & PKIX | PS | 2007 | IKEv2 | S+ | S+ |   |   |

## Slide 16

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | Uses of Cryptographic Algorithms |   |   |   |   |   |   |   |
| RFC2410 |   | NULL Encryption | PS | 1998 |   | M | M |   | 2010/03 |
| RFC4835 | 3.1.1 | NULL Encryption |   |   | ESP | M | M |   | 2010/03 |
| RFC2451 |   | ESP CBC-mode Algorithms | PS | 1998 |   | M | M |   | 2010/03 |
|   | 2.6 | 3DES-CBC  |   |   | ESP | M | M |   | 2010/03 |
| RFC4835 | 3.1.1 | 3DES-CBC  |   |   | ESP | M | M |   | 2010/03 |
| RFC4307 | 3.1.1 | 3DES-CBC |   |   | IKEv2 | M | M |   | 2010/03 |
| RFC3602 |   | AES-CBC | PS | 2003 |   | M | M |   | 2010/03 |
| RFC4835 | 3.1.1 | AES-CBC with 128 bit keys |   |   | ESP | M | M |   | 2010/03 |
| RFC4307 | 3.1.1 | AES-CBC with 128 bit keys |   |   | IKEv2 | M | M |   | 2010/03 |
| RFC3686 |   | AES-CTR  | PS | 2004 |   | S | S |   |   |
| RFC4835 | 3.1.1 | AES-CTR with 128-bit keys  |   |   | ESP | S | S |   |   |
| RFC4309 |   | AES-CCM | PS | 2005 |   | O | O |   |   |
| RFC4835 | 3.1.2 | AES-CCM with 128 bit keys |   |   | ESP | O | O |   |   |
| RFC4106 |   | AES-GCM | PS | 2005 |   | O | O |   |   |
|   | 6 | 128-bit ICV |   |   | ESP | O | O |   |   |
|   | 8.1 | AES-GCM with 128 bit keys |   |   | ESP | O | O |   |   |
| RFC4543 |   | AES-GMAC | PS | 2006 |   | O | O |   |   |
|  | 5.4 | ENCR-NULL-AUTH-AES-GMAC  128 bit keys |   |   | ESP | O | O |   |   |
|   | 5.4 | AUTH-AES-GMAC with 128 bit keys |   |   | AH | O | O |   |   |
| RFC2404 |   | HMAC-SHA-1-96 | PS | 1998 |   | M | M |   | 2010/03 |
| RFC4835 | 3.1.1/3.2 | HMAC-SHA-1 |   |   | ESP or AH | M | M |   | 2010/03 |
| RFC4307 | 3.1.1 | HMAC-SHA-1  |   |   | IKEv2 | M | M |   | 2010/03 |
| RFC4307 | 3.1.4 | HMAC-SHA-1 as a PRF |   |   | IKEv2 | M | M |   | 2010/03 |
| RFC4868 |   | HMAC-SHA-256 | PS | 2007 |   | S+ | S+ |   |   |
|   | 2.3 | HMAC-SHA-256-128 |   |   | ESP or AH | S+ | S+ |   |   |
|   |   | HMAC-SHA-256 |   |   | IKEv2 | S+ | S+ |   |   |
|   | 2.4 | HMAC-SHA-256 as a PRF |   |   | IKEv2 | S+ | S+ |   |   |
| RFC3566 |   | AES-XCBC-MAC-96 | PS | 2003 |   | S+ | S+ |   |   |
| RFC4835 | 3.1.1/3.2 | AES-XCBC-MAC-96 |   |   | ESP or AH | S+ | S+ |   |   |
| RFC4434 |   | AES-XCBC-PRF-128 | PS | 2006 |   | S+ | S+ |   |   |
| RFC4307 | 3.1.4 | AES128-XCBC-PRF  |   |   | IKEv2 | S+ | S+ |   |   |

## Slide 17

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | Transition Mechanisms Requirements |   |   |   |   |   |   |   |
| RFC4038 |   | Apllication Aspects of IPv6 Transition | INF | 2005 | IPv4 | S |   |   |   |
| RFC4213 |   | Transition Mech. for  Hosts & Routers | PS | 2005 | IPv4 | c(M) | c(M) |   | 2010/03 |
|   | 2 | Dual Stack IPv4 and IPv6 |   |   | IPv4 | c(M) | c(M) |   | 2010/03 |
|   | 3 | Configured Tunnels |   |   | IPv4 | c(S) | c(M) |   | 2010/03 |
| RFC4891 |   | Using IPsec to Secure IPv6-in-IPv4 Tunnels | INF | 2007 | IPv4 | c(S) | c(M) |   | 2010/03 |
| RFC2473 |   | Generic Packet Tunneling in IPv6 | PS | 1998 | IPv4 |   | c(M) |   | 2010/03 |
| RFC2784 |   | Generic Routing Encapsualation | PS | 2000 | IPv4 |   | c(S) |   |   |
|   |   |   |   |   |   |   |   |   |   |
|   |   | IPv6 Provider Edge MPLS Tunneling |   |   |   |   |   |   |   |
| RFC4798 |   | Connecting IPv6 islands over IPv4 MPLS  (6PE) | PS | 2007 | IPv4 & 6PE |   | c(M) |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Network Management Requirements |   |   |   |   |   |   |   |
| RFC3411 |   | SNMP v3 Management Framework  | S62 | 2002 | SNMP | c(M) | M |   | 2010/03 |
| RFC3412 |   | SNMP Message Process and Dispatch | S62 | 2002 | SNMP | c(M) | M |   | 2010/03 |
| RFC3413 |   | SNMP Applications | S62 | 2002 | SNMP | c(M) | M |   | 2010/03 |
|   | 1.2 | Command Responder |   |   | SNMP | c(M) | M |   | 2010/03 |
|   | 1.3 | Notification Generator |   |   | SNMP | c(S) | M |   | 2010/03 |
| RFC3414 |   | User-based Security Model for SNMPv3 | S62 | 2002 | SNMP | c(M) | M |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Management Information Bases |   |   |   |   |   |   |   |
| RFC4293 |   | MIB for the IP | PS | 2006 | SNMP | c(M) | M |   | 2010/03 |
| RFC4292 |   | MIB for IP Forwarding Table | PS | 2006 | SNMP |   | M |   | 2010/03 |
| RFC4022 |   | MIB for TCP | PS | 2006 | SNMP | c(S+) | S+ |   |   |
| RFC4113 |   | MIB for UDP | PS | 2005 | SNMP | c(S+) | S+ |   |   |
| RFC4087 |   | MIB for IP Tunnels | PS | 2005 | SNMP & IPv4 |   | c(M) |   | 2010/03 |
| RFC4807 |   | MIB for Ipsec Policy Database Configuration | PS | 2007 | SNMP & IPsec-v3 |   | M |   | 2010/03 |
| RFC4295 |   | MIB for Mobile IP | PS | 2006 | SNMP & MIP |   | c(M) |   | 2010/03 |
| RFC3289 |   | MIB for DiffServ | PS | 2002 | SNMP & DS |   | M |   | 2010/03 |

## Slide 18

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | Multicast Requirements |   |   |   |   |   |   |   |
| RFC3810 |   | MLD Version 2 for IPv6 | PS | 2004 |   | M | M |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
| RFC4607 |   | Source-Specific Multicast for IP | PS | 2006 | SSM | c(M) | c(M) |   | 2010/03 |
| RFC4604 |   | MLDv2 for Source Specifice Multicast (SSM) | PS | 2006 | SSM | c(M) | c(M) |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Protocol Indepdendent Multicast (PIM) |   |   |   |   |   |   |   |
| RFC4601 |   | PIM Sparse Mode (SM) | PS | 2006 | SSM |   | c(S+) |   |   |
| RFC4609 |   | PIM-SM  Security Issues / Enhancements | INF | 2006 | SSS |   | c(S) |   |   |
| RFC3956 |   | Embedding Rendezvous Point (RP)  Mcast Addr | PS | 2004 | SSM |   | c(S+) |   |   |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Mobility Requirements |   |   |   |   |   |   |   |
| RFC3775 |   | Mobility Support in IPv6 | PS | 2004 | MIP | c(M) | c(M) |   | 2010/03 |
|   | 8.1 | All Nodes as Correspondent Node |   |   | MIP | M |   |   | 2010/03 |
|   | 8.2 | Route Optimization |   |   | MIP | c(M) |   |   | 2010/03 |
|   | 8.2 | Allow route optimization to be  disabled. |   |   | MIP | c(M) |   |   | 2010/03 |
|   | 8.3 | All IPv6 Routers |   |   | MIP |   | M |   | 2010/03 |
|   | 8.4 | Home Agents |   |   | MIP |   | c(M) |   | 2010/03 |
|   | 8.5 | Mobile Nodes |   |   | MIP | c(M) |   |   | 2010/03 |
| RFC4282 |   | The Network Access Identifier | PS | 2005 | MIP | c(S+) |  c(S+) |   |   |
| RFC4283 |   | Mobile Node Identifier option for MIPV6 | PS | 2005 | MIP | c(S+) | c(S+) |   |   |
| RFC4877 |   | MIPv6 Operation with IKEv2 and IPsec-v3 | PS | 2004 | MIP | c(M) | c(M) |   | 2010/03 |
|   |   |   |   |   |   |   |   |   |   |
| RFC3963 |   | Network Mobility (NEMO) Basic Support | PS | 2005 | NEMO |   | c(M) |   | 2010/03 |

## Slide 19

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | Quality of Service Requirements |   |   |   |   |   |   |   |
| RFC2474 |   | Differentiated Services (DiffServ) | PS | 1988 | DS | c(M) | M |   | 2010/03 |
| RFC2475 |   | An Architecture for Differentiated Services | INF | 1998 | DS |   | S |   |   |
| RFC3260 |   | New Terminology / Clarifications for Diffserv | INF | 2002 | DS |   | S |   |   |
| RFC2983 |   | Differentiated Services and Tunnels | INF | 2000 | DS |   | S |   |   |
| RFC4594 |   | Config Guidelines for DS Service Classes | INF | 2006 | DS |   | S |   |   |
| RFC3086 |   | Def. of DiffServe Per Domain Behaviors (PDB) | INF | 2001 | DS |   | S |   |   |
| RFC3140 |   | Per Hop Behavior (PHB) Identification Codes | PS | 2001 | DS | c(M) | M |   | 2010/03 |
| RFC2597 |   | Assured Forwarding PHB Group | PS | 1999 | DS |   | S+ |   |   |
| RFC3246 |   | An Expedited Forwarding PHB | PS | 2002 | DS |   | S+ |   |   |
| RFC3247 |   | Supplemental Info for the New EF PHB | INF | 2002 | DS |   | S+ |   |   |
|   |   |   |   |   |   |   |   |   |   |
| RFC3168 |   | Explicit Congestion Notification (ECN) to IP | PS | 2001 | ECN | S | S+ |   |   |
|   |   |   |   |   |   |   |   |   |   |
|   |   | Link  Specific Requirements |   |   |   |   |   |   |   |
| RFC2464 |   | IPv6 over Ethernet | PS | 1998 | Link | c(M) | c(M) |   | 2010/03 |
| RFC2467 |   | IPv6 over FDDI  | PS | 1998 | Link | c(M) | c(M) |   | 2010/03 |
| RFC5072 |   | IPv6 over PPP | PS | 1998 | Link | c(M) | c(M) |   | 2010/03 |
| RFC2491 |   | IPv6 over Non-Broadcast Multiple Access (NBMA) networks  | PS | 1999 | Link | c(M) | c(M) |   | 2010/03 |
| RFC2492 |   | IPv6 over ATM Networks  | PS | 1999 | Link | c(M) | c(M) |   | 2010/03 |
| RFC2497 |   | IPv6 over ARCnet  | PS | 1999 | Link | c(M) | c(M) |   | 2010/03 |
| RFC2590 |   | IPv6  over Frame Relay  | PS | 1999 | Link | c(M) | c(M) |   | 2010/03 |
| RFC3146 |   | IPv6 over IEEE 1394 Networks | PS | 2001 | Link | c(M) | c(M) |   | 2010/03 |
| RFC3572 |   | IPv6 over MAPOS (SONET/SDH)  | INF | 2003 | Link | c(M) | c(M) |   | 2010/03 |
| RFC4338 |   | IPv6 & IPv4 over Fibre Channel  | PS | 2006 | Link | c(M) | c(M) |   | 2010/03 |
| RFC4944 |   | IPv6 over IEEE 802.15.4 Networks | PS | 2007 | Link | c(M) | c(M) |   | 2010/03 |

## Slide 20

| Spec / |   | USGv6-V1 Node Requirements |   |   | Condition /  |   |   |   | Effective |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Reference | Section | Title / Definition | Status | Year | Context | Host | Router | NPD | Date |
|   |   | Packet Compression Technologies |   |   |   |   |   |   |   |
| RFC2507 |   | IP Header Compression | PS | 1999 |   | O  | O  |   |   |
| RFC3173 |   | IP Payload Compression Protocol (IPComp) | PS | 2001 |   | O  | O  |   |   |
| RFC4995 |   | RObust Header Compression (ROHC) Framework | PS | 2007 | ROHC | c(M) | c(M) |   | 2010/03 |
| RFC4996 |   | ROHC Profile for TCP | PS | 2007 | ROHC | c(M) | c(M) |   | 2010/03 |
| RFC3095 |   | ROHC Profiles for RTP, UDP, ESP and Uncomp | PS | 2001 | ROHC | c(M) | c(M) |   | 2010/03 |
| RFC4815 |   | Corrections and Clarifications to RFC3095 | PS | 2007 | ROHC | c(M) | c(M) |   | 2010/03 |
| RFC3843 |   | ROHC Profile for IP Only | PS | 2004 | ROHC | c(S+) | c(S+) |   |   |
| RFC3241 |   | ROHC over PPP | PS | 2002 | ROHC & Link | c(M) | c(M) |   | 2010/03 |
| RFC4362 |   | ROHC: Link Assisted for IP/UDP/RTP | PS | 2006 | ROHC | c(S+) | c(S+) |   |   |
|   |   | Network Protection Device Requirements |   |   |   |   |   |   |   |
| SP500-267 | 6.12.3.1 | IPv6 connectivity |   |   | NPD |   |   | M | 2010/03 |
| SP500-267 | 6.12.3.2 | Dual Stack |   |   | NPD |   |   | M | 2010/03 |
| SP500-267 | 6.12.3.3 | Administrative Functionality |   |   | NPD |   |   | M | 2010/03 |
| SP500-267 | 6.12.3.4 | Authentication and Authorization |   |   | NPD |   |   | M | 2010/03 |
| SP500-267 | 6.12.3.5 | Security of Control and Comms |   |   | NPD |   |   | M | 2010/03 |
| SP500-267 | 6.12.3.6 | Persistence |   |   | NPD |   |   | M | 2010/03 |
| SP500-267 | 6.12.3.7 | Logging and Alerts |   |   | NPD |   |   | M | 2010/03 |
| SP500-267 | 6.12.3.8 | Fragmented Packets Handling |   |   | NPD |   |   | M | 2010/03 |
| SP500-267 | 6.12.3.9 | Tunneled Traffic Handling |   |   | NPD |   |   | M | 2010/03 |
| SP500-267 | 6.12.4.1.1 | Asymmetrical blocking |   |   | FW |   |   | M | 2010/03 |
| SP500-267 | 6.12.4.1.2 | Port/protocol/address blocking |   |   | FW |   |   | M | 2010/03 |
| SP500-267 | 6.12.4.1.3 | Performance under load |   |   | FW & IDS |   |   | M | 2010/03 |
| SP500-267 | 6.12.4.2.1 | No violation of trust barriers |   |   | APFW |   |   | M | 2010/03 |
| SP500-267 | 6.12.4.2.2 | Session Traffic Auth |   |   | APFW |   |   | M | 2010/03 |
| SP500-267 | 6.12.4.2.3 | Email, File Filtering |   |   | APFW |   |   | M | 2010/03 |
| SP500-267 | 6.12.5.1.1 | Known Attack Detection |   |   | IDS |   |   | M | 2010/03 |
| SP500-267 | 6.12.5.1.2 | Malformed pkt detection |   |   | IDS |   |   | M | 2010/03 |
| SP500-267 | 6.12.5.1.3 | Port scan detection |   |   | IDS |   |   | M | 2010/03 |
| SP500-267 | 6.12.5.1.4 | Tunneled traffic detection |   |   | IDS |   |   | M | 2010/03 |