Establishing the Technical Basis for Trustworthy Networking

USGv6 Program

Revision 1 Update

Doug Montgomery (dougm@nist.gov)

https://www.nist.gov/programs-projects/usgv6-program
Establishing the Technical Basis for Trustworthy Networking

USGv6 Program – Revision 1

• What has changed?

• Update evolving standards & new IPv6 capabilities.

• Remove failed technologies from ~2008.

• Improve profile utility for specifying user requirements.

• Expand test program scope and completeness. 

• Test V6-Only capabilities

• Maintain alignment with IPv6Ready testing program.

• Simplify means of specifying requirements / capability.

• Consolidate and simplify program documentation.

• Enable other user groups reusing profile & test program.

11/4/19 USGv6 Program

NIST.SP.500-267Br1
Establishing the Technical Basis for Trustworthy Networking

Please Review & Comment !

DRAFT3 of USGv6 Revision 1 Specifications: https://www.nist.gov/programs-projects/usgv6-program

NIST and its partners in the USGv6 Program solicit public review and comment on the following revised 

specifications:

• "NIST IPv6 Profile", draft3-nist-sp-500-267ar1.pdf , October 2019.

• "NISTv6 Capabilities Table", draft3-nist-sp-500-267ar1s.pdf , October 2019.

• "USGv6 Profile", draft3-nist-sp-500-267br1.pdf , October 2019.

• "USGv6 Capabilities Table", draft3-nist-sp-500-267br1s.pdf , October 2019.

• "USGv6 Test Program Guide", draft3-nist-sp-500-281ar1.pdf , October 2019.

• "USGv6 Suppliers Declaration of Conformity", draft3-nist-sp-500-281ar1s.pdf , October 2019.

• "USGv6 Test Methods: General Description and Validation", draft3-nist-sp-500-281br1.pdf , October 2019.

Comments should be submitted to usgv6-program@nist.gov using the attached template: draft-usgv6-r1-

comment-template.xlsx .

REVISED DRAFT DOCUMENTS AVAILABLE FOR A 3RD ROUND OF PUBLIC COMMENTS. COMMENTS 

DUE BY NOVEMBER 8, 2019.

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

Refactoring Program Documentation

11/4/19 USGv6 Program

NIST.SP.500-267

NISTv6 

Capability Definitions

NISTv6-r1 

Capabilities Table

NIST.SP.500-267Ar1 NIST.SP.500-267Ar1s

Generic IPv6 Capabilities Profile

Requirements match new ETF 

Node Requirements

No mention or coupling to USG

Generic conformance guidance
Establishing the Technical Basis for Trustworthy Networking

Revised USGv6 Program Documentation.

11/4/19 USGv6 Program

NIST.SP.500-267

NIST.SP.500-281Ar1 NIST.SP.500-281Ar1s NIST.SP.500-281Br1

NIST.SP.500-281 NIST.SP.500-273

NISTv6-r1

Profile USGv6-r1 Profile USGv6-r1 Capabilities Table USGv6 Conformance USGv6 SDOC USGv6 Accreditation

NIST.SP.500-267Br1s

NIST.SP.500-267Ar1 NIST.SP.500-267Br1
Establishing the Technical Basis for Trustworthy Networking

USGv6-r1 Capabilities Table

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

UCT Concepts and Notation

11/4/19 USGv6 Program

• IPv6 Specifications 

mapped into labeled 

Capabilities

• Grouped by logic and 

function.

• Testable units.

• Aligned to industry 

testing programs.
Establishing the Technical Basis for Trustworthy Networking

UCT Concepts and Notation

11/4/19 USGv6 Program

• Selection Criteria

• Defined in terms of 

functional roles.

• Host / Router

• Client / Server

• Not Product Classes

• Functional roles just 

identify different 

behavior / requirement 

classes in RFCs
Establishing the Technical Basis for Trustworthy Networking

UCT Concepts and Notation

11/4/19 USGv6 Program

• Why not just cite RFCs?

• Organization of RFCs 

often contains both 

mandatory and 

optional behavior.

• Behavior for multiple 

functional roles.

• Organization often 

based upon packet 

formats.
Establishing the Technical Basis for Trustworthy Networking

UCT Concepts and Notation

11/4/19 USGv6 Program

• Profile evolution

• Flags indicate capability 

changes since last 

revision

• __ - no change

• U – updated requirements

• N – new requirements
Establishing the Technical Basis for Trustworthy Networking

Key Technical Changes

• Testing in IPv6 Only Networks

• New IPv6-Only Capability

• Users can require and vendors can declare support for IPv6-Only operation.

• Requires Full Life Cycle of product to be fully functional in absence of IPv4.

• Install, Manage, Update, UI

• Requires other claimed capabilities to be tested in IPv6-Only environment.

• Should we test other capabilities in IPv6-Only by default going forward?

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

NIST IPv6 Profile

• Capabilities Templates

• Defines broad capabilities groups

• E.g. Security Capabilities

• Identifies functional roles

• Host, Router, NPP, Application.

• Defines individual named capabilities

• E.g., IPsec – support for the IP security architecture.

• Defines recommended requirement level

• M à Mandatory

• O à Optional

• O:I à Optional, must choose 1

• X à Not recommended

• M = mandatory in IETF Node Requirements specification.

• Provides guidance

• Text provides additional explanation of capability

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

NIST IPv6 Profile

• Capabilities Requirements Definition

• Maps named capabilities to IETF specifications

• By default, implies support of all the MUST 

requirements in RFC.

• Where necessary, requirements of IETF specifications 

may be enhanced, with specific section references.

• Capability Combinations

• Cap1 – requirements apply with capability selected.

• Cap2 & Cap3 – requirements only apply when both 

capabilities are selected.

• Cap4 | Cap5 – requirements apply when either 

capability is selected.

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

User Requirements & Product Capabilities

• Capability Summary Strings

• CSS_NAME = Profile: Functional_Role + Capability 

+ Capability + ...

• Can express choice [IPsec|TLS]

• Only form of requirements specification 

going forward.

• Profile provides capability taxonomy and selection 

guidance.

• User develops named capability strings to describe 

requirements.

• Product Capabilities

• Products don’t conform to the USGv6 profile, they 

conform to specific capability strings.

• SDoCs express product capabilities in terms of the 

same strings.

• A single “product” may support multiple capability 

configurations.

11/4/19 USGv6 Program

Default-Desktop = USGv6-r1:Host + Core + SLAAC + Addr-Arch + Multicast + DualStack + DHCP-client + DNS-Client + URI + Link=Ethernet. 

Default-App-Server = USGv6-r1:Host + Core + Addr-Arch + Multicast + Dual-Stack 

+ [IPSec|TLS] + URI + DNS-Client + Link=Ethernet.

Default-Embedded = USGv6-r1:Host + Core + Addr-Arch + Multicast + SLAAC + 

Link=Ethernet

Default-IOT = USGv6-r1:Host + 6LoWPAN + Link=802.15.4

Default-Enterprise-Router = USGv6-r1:Router + Core + Addr-Arch + Multicast + 

[OSPF|ISIS] + [SNMP|NETCONF] + Dual-Stack + Link=Ethernet

Default-Intranet-Router = USGv6-r1:Router + Core + Addr-Arch + Multicast + OSPF + 

[SNMP|NETCONF] + [IPsec|TLS] + [Dual-Stack|Tunneling] + Multicast-Routing + 

Link=Ethernet

Default-CE-Router = USGv6-r1:Router + CE-Router + Link=Ethernet

Default-MAP-E = USGv6-r1:Router + CE-Router + MAP-E + Link=Ethernet

Default-Border-Router = USGv6-r1:Router + Core + Addr-Arch + Multicast + BGP + TLS 

+ [OSPF|ISIS] + [SNMP|NETCONF] + Dual-Stack + Tunneling + Link=Ethernet

Default-SGW = USGv6-r1:Router + Core + TLS + IPsec-VPN + Link=Ethernet

Default-Firewall = USGv6-r1:NPP + Firewall

Default-IDS/IPS = USGv6-r1:NPP + IPS + IDS
Establishing the Technical Basis for Trustworthy Networking

Capability Summary Strings

11/4/19 USGv6 Program

• <Label>=Profile:<Host|Router|NPD>+<Capabilities>

• Labels are groups of the requirements a procurement might want to specify. 

• Can specify capability choice. e.g. [DHCP-Client|SLAAC] 

• A single product might have multiple capability strings for different stacks / management.

• Agency-Default-Server=USGv6-r1:Host+Core+SLAAC+AddrArch+Multicast+[IPsec|TLS]+DHCP-Client+URI+DNS-Client+Link=Ethernet

NIST.SP.500-267Ar1

User / System 

Requirements

Procurement 

Requirements

Web-Server=NISTv6-

r1:Host+Core+SLAAC

+AddrArch+Multicast+[IPsec

|TLS]+DHCPClient+URI+DNSClient+Link=Ethernet

IPv6 Capable 

Product

Standards

Profile

NIST.SP.500-267Br1

User Group

Profile
Establishing the Technical Basis for Trustworthy Networking

USGv6 Test Program

11/4/19 USGv6 Program

• USGv6 Test Program committed to converge / harmonize 

• IPv6 Ready Logo Test Specifications

• NIST and IPv6 Forum sign MOU

• DoD Generic Test Plan test cases

• Claims of compliance documented using Supplier’s Declaration of Conformity (SDoC)

IPv6 Capable 

Product

NIST.SP.500-281Ar1s

USGv6 

SDOC

USGv6 Accredited 

Laboratory

Standard Test 

Methods

Conformance 

+ 

Interoperability

Agency-DefaultServer=NISTv6-

r1:Host+Core+SLAAC

+AddrArch+Multicast+[IPsec

|TLS]+DHCPClient+URI+DNSClient+Link=Ethernet

Product IPv6 

Capabilities
Establishing the Technical Basis for Trustworthy Networking

USGv6 Testing Program Definitions

• Quality Program for Test Labs.

• Allows for 1st, 2nd, 3rd party labs.

• Requires 3rd party accreditation.

• Defines requirements for accreditation for 

specific test methods. 

• Defines methods for inter-laboratory 

comparisons and quality control.

• Defines Detailed Issues of Testing

• Product life cycles

• Composite and OEM products

• Suppliers Declaration of Conformity (SDOC) 

reporting.

11/4/19 USGv6 Program

NIST.SP.500-281Ar1 NIST.SP.500-281Br1
Establishing the Technical Basis for Trustworthy Networking

USGv6 Test Program

• USGv6 Tested Product List 

• https://www.iol.unh.edu/registry/usgv6

• Hosts Tested (298)

• Routers Tested (142)

• NPDs Tested (34)

• ~1400 products tested for USGv6

• Over 10,000 products listed.

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

Coordination and Consolidation of Efforts!

• Avoid Duplication of Efforts!

• Primary impact is creating undue 

burden on industry!

• Divergent product requirements.

• Repetitive, non-standard testing 

requirements.

• Non portability of test results

• Possible rejection of all profile / test 

efforts.

• Already many profile / test activities

• IPv6 Ready, USGv6, DoD/UCR, 

Broadband Forum, ETSI, etc.

• Country specific profiles / test 

programs beginning to emerge

• Malaysia, etc.

• Profile / Testing Convergence

• Conformance / interop testing of 

commodity products should 

converge to the maximum extent 

possible.

• Open, standardized test suites.

• Maximum leverage of industry driven 

test programs.

• Common test reporting mechanism.

• Use Case Specific Testing

• Free resources to focus more 

important testing issues such as: 

information assurance, system 

integration, performance, scaling, 

etc.

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

USGv6 Profile – Derived from NISTv6

• Specified as delta to NISTv6r1

• Changes to capability selection 

recommendations.

• Changes to conformance 

requirements.

• New example CSS strings.

• USGv6-Capable-Host = USGv6-r1:Host + IPv6-Only + Core 

+ Addr-Arch + Multicast + [SLAAC|DHCP-Client] + 

[IPsec|TLS] + Link=Ethernet

• USGv6-Capable-Router = USGv6-r1:Router + IPv6-Only + 

Core + Addr-Arch + Multicast + SLAAC + [IPsec|TLS] + 

[SNMP|NETCONF] + [CE-Router|OSPF|IS-IS|BGP] + 

DiffServ + [Tunneling-IP|Tunneling-UDP] + Link=Ethernet

• USGv6-Capable-Switch = USGv6-r1:Switch + IPv6-Only + 

DHCPv6-Guard + RA-Guard + MLD-Snooping + 

Link=Ethernet

• USGv6-Capable-Application = USGv6-r1:App-Serv + IPv6-

Only + App-Serv=[TBD] 

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

USGv6 Profile Establishes a Vocabulary

• Example: Use of NISTv6 Profile to Express DoD requirements:

• Requirements from: “DoD IPv6 Standard Profiles For IPv6 Capable Products Version 6.0", DISR IPv6 Standards Technical Working 

Group, July 2011. Online at: https://www.hpc.mil/images/hpcdocs/ipv6/disr_ipv6_profile_version_6_july_2011.pdf

• DOD-Host = USGv6-r1:Host + Core + [SLAAC|DHCP-Client] + Addr-Arch + DNS-Client + Multicast + IPSec + [DualStack|Tunneling] + Link=Ethernet

• DOD-Simple-Server = USGv6-r1:Host + Core + [SLAAC|DHCP-Client] + Addr-Arch + Link=Ethernet

• DOD-Advanced-Server = USGv6-r1:Host + Core + Addr-Arch + DNS-Client + Multicast + IPSec + [DualStack|Tunneling] + Link=Ethernet

• DOD-Router = USGv6-r1:Router + Core + SLAAC + Addr-Arch + Multicast + IPSec + DS + SNMP + [DualStack|Tunneling] + Link=Ethernet

• DOD-L3-Switch = USGv6-r1:Router + Core + Addr-Arch + Multicast + [Dual-Stack|Tunneling] + DS + Link=Ethernet

• DOD-IAD = Core + Addr-Arch + Multicast + Link=Ethernet

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

“USGv6 Conformance” - Misconceptions

• Products can’t “conform to 

USGv6 Profile”.

• They can conform to a requirement 

defined in terms of the profile.

• USGv6-Capable-Host = USGv6-r1:Host + 

IPv6-Only + Core + Addr-Arch + Multicast + 

[SLAAC|DHCP-Client] + [IPsec|TLS] + Link=Ethernet

• Tested vs Approved Products?

• USGv6 Test Program results in a 

report of claimed and tested IPv6 

product capabilities.

• Having a USGv6 SDoC does not mean 

it is a USGv6 approved product!

• It is up to users to examine the 

results and to see if they meet their 

acquisition requirements 

requirements.

• FAR requirements

• “Unless the agency Chief Information 

Officer waives the requirement, when 

acquiring information technology using 

Internet Protocol, the requirements 

documents must include reference to the 

appropriate technical capabilities 

defined in the USGv6 Profile (NIST 

Special Publication 500-267) and the corresponding declarations of 

conformance defined in the USGv6 Test 

Program.”

• Defining Acquisition Requirements

• Appendix A of the NIST IPv6 profile 

and USGv6 Profile contain numerous 

examples of Capability Summary 

Strings.

• Specifying a CSS for a specific type 

of product effectively defines an 

approved product list.

• Adapt examples to your needs.

• NIST-Laptop = USGv6-r1:Host + IPv6-Only + Core + Addr- Arch + Multicast + SLAAC + DHCP-Client + TLS + Link=WiFi

11/4/19 USGv6 Program
Establishing the Technical Basis for Trustworthy Networking

USGv6 Program: The Big Picture

11/4/19 USGv6 Program

USGv6

Program
Establishing the Technical Basis for Trustworthy Networking

Questions and Discussion

11/4/19 USGv6 Program

• For more information:

• USGv6 Program

• https://www.nist.gov/programs-projects/usgv6-program

• usgv6-program@nist.gov

• Advanced Network Technologies Division. 

• https://www.nist.gov/itl/antd

• Information Technology Laboratory 

• https://www.nist.gov/itl