1124 lines
38 KiB
Plaintext
1124 lines
38 KiB
Plaintext
|
||
|
||
|
||
|
||
|
||
|
||
Network Working Group J. Loughney, Ed.
|
||
Request for Comments: 4294 Nokia
|
||
Category: Informational April 2006
|
||
|
||
|
||
IPv6 Node Requirements
|
||
|
||
Status of This Memo
|
||
|
||
This memo provides information for the Internet community. It does
|
||
not specify an Internet standard of any kind. Distribution of this
|
||
memo is unlimited.
|
||
|
||
Copyright Notice
|
||
|
||
Copyright (C) The Internet Society (2006).
|
||
|
||
Abstract
|
||
|
||
This document defines requirements for IPv6 nodes. It is expected
|
||
that IPv6 will be deployed in a wide range of devices and situations.
|
||
Specifying the requirements for IPv6 nodes allows IPv6 to function
|
||
well and interoperate in a large number of situations and
|
||
deployments.
|
||
|
||
Table of Contents
|
||
|
||
1. Introduction ....................................................2
|
||
1.1. Requirement Language .......................................3
|
||
1.2. Scope of This Document .....................................3
|
||
1.3. Description of IPv6 Nodes ..................................3
|
||
2. Abbreviations Used in This Document .............................3
|
||
3. Sub-IP Layer ....................................................4
|
||
3.1. Transmission of IPv6 Packets over Ethernet Networks
|
||
- RFC 2464 .................................................4
|
||
3.2. IP version 6 over PPP - RFC 2472 ...........................4
|
||
3.3. IPv6 over ATM Networks - RFC 2492 ..........................4
|
||
4. IP Layer ........................................................5
|
||
4.1. Internet Protocol Version 6 - RFC 2460 .....................5
|
||
4.2. Neighbor Discovery for IPv6 - RFC 2461 .....................5
|
||
4.3. Path MTU Discovery and Packet Size .........................6
|
||
4.4. ICMP for the Internet Protocol Version 6 (IPv6) -
|
||
RFC 2463 ...................................................7
|
||
4.5. Addressing .................................................7
|
||
4.6. Multicast Listener Discovery (MLD) for IPv6 - RFC 2710 .....8
|
||
5. DNS and DHCP ....................................................8
|
||
5.1. DNS ........................................................8
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 1]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
5.2. Dynamic Host Configuration Protocol for IPv6
|
||
(DHCPv6) - RFC 3315 ........................................9
|
||
6. IPv4 Support and Transition ....................................10
|
||
6.1. Transition Mechanisms .....................................10
|
||
7. Mobile IP ......................................................10
|
||
8. Security .......................................................10
|
||
8.1. Basic Architecture ........................................10
|
||
8.2. Security Protocols ........................................11
|
||
8.3. Transforms and Algorithms .................................11
|
||
8.4. Key Management Methods ....................................12
|
||
9. Router-Specific Functionality ..................................12
|
||
9.1. General ...................................................12
|
||
10. Network Management ............................................12
|
||
10.1. Management Information Base Modules (MIBs) ...............12
|
||
11. Security Considerations .......................................13
|
||
12. References ....................................................13
|
||
12.1. Normative References .....................................13
|
||
12.2. Informative References ...................................16
|
||
13. Authors and Acknowledgements ..................................18
|
||
|
||
1. Introduction
|
||
|
||
The goal of this document is to define the common functionality
|
||
required from both IPv6 hosts and routers. Many IPv6 nodes will
|
||
implement optional or additional features, but this document
|
||
summarizes requirements from other published Standards Track
|
||
documents in one place.
|
||
|
||
This document tries to avoid discussion of protocol details, and
|
||
references RFCs for this purpose. This document is informational in
|
||
nature and does not update Standards Track RFCs.
|
||
|
||
Although the document points to different specifications, it should
|
||
be noted that in most cases, the granularity of requirements are
|
||
smaller than a single specification, as many specifications define
|
||
multiple, independent pieces, some of which may not be mandatory.
|
||
|
||
As it is not always possible for an implementer to know the exact
|
||
usage of IPv6 in a node, an overriding requirement for IPv6 nodes is
|
||
that they should adhere to Jon Postel's Robustness Principle:
|
||
|
||
Be conservative in what you do, be liberal in what you accept from
|
||
others [RFC-793].
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 2]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
1.1. Requirement Language
|
||
|
||
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
|
||
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
|
||
document are to be interpreted as described in RFC 2119 [RFC-2119].
|
||
|
||
1.2. Scope of This Document
|
||
|
||
IPv6 covers many specifications. It is intended that IPv6 will be
|
||
deployed in many different situations and environments. Therefore,
|
||
it is important to develop the requirements for IPv6 nodes to ensure
|
||
interoperability.
|
||
|
||
This document assumes that all IPv6 nodes meet the minimum
|
||
requirements specified here.
|
||
|
||
1.3. Description of IPv6 Nodes
|
||
|
||
From the Internet Protocol, Version 6 (IPv6) Specification
|
||
[RFC-2460], we have the following definitions:
|
||
|
||
Description of an IPv6 Node
|
||
|
||
- a device that implements IPv6.
|
||
|
||
Description of an IPv6 router
|
||
|
||
- a node that forwards IPv6 packets not explicitly addressed
|
||
to itself.
|
||
|
||
Description of an IPv6 Host
|
||
|
||
- any node that is not a router.
|
||
|
||
2. Abbreviations Used in This Document
|
||
|
||
ATM Asynchronous Transfer Mode
|
||
|
||
AH Authentication Header
|
||
|
||
DAD Duplicate Address Detection
|
||
|
||
ESP Encapsulating Security Payload
|
||
|
||
ICMP Internet Control Message Protocol
|
||
|
||
IKE Internet Key Exchange
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 3]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
MIB Management Information Base
|
||
|
||
MLD Multicast Listener Discovery
|
||
|
||
MTU Maximum Transfer Unit
|
||
|
||
NA Neighbor Advertisement
|
||
|
||
NBMA Non-Broadcast Multiple Access
|
||
|
||
ND Neighbor Discovery
|
||
|
||
NS Neighbor Solicitation
|
||
|
||
NUD Neighbor Unreachability Detection
|
||
|
||
PPP Point-to-Point Protocol
|
||
|
||
PVC Permanent Virtual Circuit
|
||
|
||
SVC Switched Virtual Circuit
|
||
|
||
3. Sub-IP Layer
|
||
|
||
An IPv6 node must include support for one or more IPv6 link-layer
|
||
specifications. Which link-layer specifications are included will
|
||
depend upon what link-layers are supported by the hardware available
|
||
on the system. It is possible for a conformant IPv6 node to support
|
||
IPv6 on some of its interfaces and not on others.
|
||
|
||
As IPv6 is run over new layer 2 technologies, it is expected that new
|
||
specifications will be issued. This section highlights some major
|
||
layer 2 technologies and is not intended to be complete.
|
||
|
||
3.1. Transmission of IPv6 Packets over Ethernet Networks - RFC 2464
|
||
|
||
Nodes supporting IPv6 over Ethernet interfaces MUST implement
|
||
Transmission of IPv6 Packets over Ethernet Networks [RFC-2464].
|
||
|
||
3.2. IP version 6 over PPP - RFC 2472
|
||
|
||
Nodes supporting IPv6 over PPP MUST implement IPv6 over PPP
|
||
[RFC-2472].
|
||
|
||
3.3. IPv6 over ATM Networks - RFC 2492
|
||
|
||
Nodes supporting IPv6 over ATM Networks MUST implement IPv6 over ATM
|
||
Networks [RFC-2492]. Additionally, RFC 2492 states:
|
||
|
||
|
||
|
||
Loughney Informational [Page 4]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
A minimally conforming IPv6/ATM driver SHALL support the PVC mode
|
||
of operation. An IPv6/ATM driver that supports the full SVC mode
|
||
SHALL also support PVC mode of operation.
|
||
|
||
4. IP Layer
|
||
|
||
4.1. Internet Protocol Version 6 - RFC 2460
|
||
|
||
The Internet Protocol Version 6 is specified in [RFC-2460]. This
|
||
specification MUST be supported.
|
||
|
||
Unrecognized options in Hop-by-Hop Options or Destination Options
|
||
extensions MUST be processed as described in RFC 2460.
|
||
|
||
The node MUST follow the packet transmission rules in RFC 2460.
|
||
|
||
Nodes MUST always be able to send, receive, and process fragment
|
||
headers. All conformant IPv6 implementations MUST be capable of
|
||
sending and receiving IPv6 packets; the forwarding functionality MAY
|
||
be supported.
|
||
|
||
RFC 2460 specifies extension headers and the processing for these
|
||
headers.
|
||
|
||
A full implementation of IPv6 includes implementation of the
|
||
following extension headers: Hop-by-Hop Options, Routing (Type 0),
|
||
Fragment, Destination Options, Authentication and Encapsulating
|
||
Security Payload [RFC-2460].
|
||
|
||
An IPv6 node MUST be able to process these headers. It should be
|
||
noted that there is some discussion about the use of Routing Headers
|
||
and possible security threats [IPv6-RH] that they cause.
|
||
|
||
4.2. Neighbor Discovery for IPv6 - RFC 2461
|
||
|
||
Neighbor Discovery SHOULD be supported. [RFC-2461] states:
|
||
|
||
"Unless specified otherwise (in a document that covers operating
|
||
IP over a particular link type) this document applies to all link
|
||
types. However, because ND uses link-layer multicast for some of
|
||
its services, it is possible that on some link types (e.g., NBMA
|
||
links) alternative protocols or mechanisms to implement those
|
||
services will be specified (in the appropriate document covering
|
||
the operation of IP over a particular link type). The services
|
||
described in this document that are not directly dependent on
|
||
multicast, such as Redirects, Next-hop determination, Neighbor
|
||
Unreachability Detection, etc., are expected to be provided as
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 5]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
specified in this document. The details of how one uses ND on
|
||
NBMA links is an area for further study."
|
||
|
||
Some detailed analysis of Neighbor Discovery follows:
|
||
|
||
Router Discovery is how hosts locate routers that reside on an
|
||
attached link. Router Discovery MUST be supported for
|
||
implementations.
|
||
|
||
Prefix Discovery is how hosts discover the set of address prefixes
|
||
that define which destinations are on-link for an attached link.
|
||
Prefix discovery MUST be supported for implementations. Neighbor
|
||
Unreachability Detection (NUD) MUST be supported for all paths
|
||
between hosts and neighboring nodes. It is not required for paths
|
||
between routers. However, when a node receives a unicast Neighbor
|
||
Solicitation (NS) message (that may be a NUD's NS), the node MUST
|
||
respond to it (i.e., send a unicast Neighbor Advertisement).
|
||
|
||
Duplicate Address Detection MUST be supported on all links supporting
|
||
link-layer multicast (RFC 2462, Section 5.4, specifies DAD MUST take
|
||
place on all unicast addresses).
|
||
|
||
A host implementation MUST support sending Router Solicitations.
|
||
|
||
Receiving and processing Router Advertisements MUST be supported for
|
||
host implementations. The ability to understand specific Router
|
||
Advertisement options is dependent on supporting the specification
|
||
where the RA is specified.
|
||
|
||
Sending and Receiving Neighbor Solicitation (NS) and Neighbor
|
||
Advertisement (NA) MUST be supported. NS and NA messages are
|
||
required for Duplicate Address Detection (DAD).
|
||
|
||
Redirect functionality SHOULD be supported. If the node is a router,
|
||
Redirect functionality MUST be supported.
|
||
|
||
4.3. Path MTU Discovery and Packet Size
|
||
|
||
4.3.1. Path MTU Discovery - RFC 1981
|
||
|
||
Path MTU Discovery [RFC-1981] SHOULD be supported, though minimal
|
||
implementations MAY choose to not support it and avoid large packets.
|
||
The rules in RFC 2460 MUST be followed for packet fragmentation and
|
||
reassembly.
|
||
|
||
4.3.2. IPv6 Jumbograms - RFC 2675
|
||
|
||
IPv6 Jumbograms [RFC-2675] MAY be supported.
|
||
|
||
|
||
|
||
Loughney Informational [Page 6]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
4.4. ICMP for the Internet Protocol Version 6 (IPv6) - RFC 2463
|
||
|
||
ICMPv6 [RFC-2463] MUST be supported.
|
||
|
||
4.5. Addressing
|
||
|
||
4.5.1. IP Version 6 Addressing Architecture - RFC 3513
|
||
|
||
The IPv6 Addressing Architecture [RFC-3513] MUST be supported as
|
||
updated by [RFC-3879].
|
||
|
||
4.5.2. IPv6 Stateless Address Autoconfiguration - RFC 2462
|
||
|
||
IPv6 Stateless Address Autoconfiguration is defined in [RFC-2462].
|
||
This specification MUST be supported for nodes that are hosts.
|
||
Static address can be supported as well.
|
||
|
||
Nodes that are routers MUST be able to generate link local addresses
|
||
as described in RFC 2462 [RFC-2462].
|
||
|
||
From 2462:
|
||
|
||
The autoconfiguration process specified in this document applies
|
||
only to hosts and not routers. Since host autoconfiguration uses
|
||
information advertised by routers, routers will need to be
|
||
configured by some other means. However, it is expected that
|
||
routers will generate link-local addresses using the mechanism
|
||
described in this document. In addition, routers are expected to
|
||
successfully pass the Duplicate Address Detection procedure
|
||
described in this document on all addresses prior to assigning
|
||
them to an interface.
|
||
|
||
Duplicate Address Detection (DAD) MUST be supported.
|
||
|
||
4.5.3. Privacy Extensions for Address Configuration in IPv6 - RFC 3041
|
||
|
||
Privacy Extensions for Stateless Address Autoconfiguration [RFC-3041]
|
||
SHOULD be supported. It is recommended that this behavior be
|
||
configurable on a connection basis within each application when
|
||
available. It is noted that a number of applications do not work
|
||
with addresses generated with this method, while other applications
|
||
work quite well with them.
|
||
|
||
4.5.4. Default Address Selection for IPv6 - RFC 3484
|
||
|
||
The rules specified in the Default Address Selection for IPv6
|
||
[RFC-3484] document MUST be implemented. It is expected that IPv6
|
||
nodes will need to deal with multiple addresses.
|
||
|
||
|
||
|
||
Loughney Informational [Page 7]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
4.5.5. Stateful Address Autoconfiguration
|
||
|
||
Stateful Address Autoconfiguration MAY be supported. DHCPv6
|
||
[RFC-3315] is the standard stateful address configuration protocol;
|
||
see Section 5.3 for DHCPv6 support.
|
||
|
||
Nodes which do not support Stateful Address Autoconfiguration may be
|
||
unable to obtain any IPv6 addresses, aside from link-local addresses,
|
||
when it receives a router advertisement with the 'M' flag (Managed
|
||
address configuration) set and that contains no prefixes advertised
|
||
for Stateless Address Autoconfiguration (see Section 4.5.2).
|
||
Additionally, such nodes will be unable to obtain other configuration
|
||
information, such as the addresses of DNS servers when it is
|
||
connected to a link over which the node receives a router
|
||
advertisement in which the 'O' flag ("Other stateful configuration")
|
||
is set.
|
||
|
||
4.6. Multicast Listener Discovery (MLD) for IPv6 - RFC 2710
|
||
|
||
Nodes that need to join multicast groups SHOULD implement MLDv2
|
||
[RFC-3810]. However, if the node has applications that only need
|
||
support for Any-Source Multicast [RFC-3569], the node MAY implement
|
||
MLDv1 [RFC-2710] instead. If the node has applications that need
|
||
support for Source-Specific Multicast [RFC-3569, SSM-ARCH], the node
|
||
MUST support MLDv2 [RFC-3810].
|
||
|
||
When MLD is used, the rules in the "Source Address Selection for the
|
||
Multicast Listener Discovery (MLD) Protocol" [RFC-3590] MUST be
|
||
followed.
|
||
|
||
5. DNS and DHCP
|
||
|
||
5.1. DNS
|
||
|
||
DNS is described in [RFC-1034], [RFC-1035], [RFC-3152], [RFC-3363],
|
||
and [RFC-3596]. Not all nodes will need to resolve names; those that
|
||
will never need to resolve DNS names do not need to implement
|
||
resolver functionality. However, the ability to resolve names is a
|
||
basic infrastructure capability that applications rely on and
|
||
generally needs to be supported. All nodes that need to resolve
|
||
names SHOULD implement stub-resolver [RFC-1034] functionality, as in
|
||
RFC 1034, Section 5.3.1, with support for:
|
||
|
||
- AAAA type Resource Records [RFC-3596];
|
||
|
||
- reverse addressing in ip6.arpa using PTR records [RFC-3152];
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 8]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
- EDNS0 [RFC-2671] to allow for DNS packet sizes larger than 512
|
||
octets.
|
||
|
||
Those nodes are RECOMMENDED to support DNS security extensions
|
||
[RFC-4033], [RFC-4034], and [RFC-4035].
|
||
|
||
Those nodes are NOT RECOMMENDED to support the experimental A6 and
|
||
DNAME Resource Records [RFC-3363].
|
||
|
||
5.2. Dynamic Host Configuration Protocol for IPv6 (DHCPv6) - RFC 3315
|
||
|
||
5.2.1. Managed Address Configuration
|
||
|
||
The method by which IPv6 nodes that use DHCP for address assignment
|
||
can obtain IPv6 addresses and other configuration information upon
|
||
receipt of a Router Advertisement with the 'M' flag set is described
|
||
in Section 5.5.3 of RFC 2462.
|
||
|
||
In addition, in the absence of a router, those IPv6 nodes that use
|
||
DHCP for address assignment MUST initiate DHCP to obtain IPv6
|
||
addresses and other configuration information, as described in
|
||
Section 5.5.2 of RFC 2462. Those IPv6 nodes that do not use DHCP for
|
||
address assignment can ignore the 'M' flag in Router Advertisements.
|
||
|
||
5.2.2. Other Configuration Information
|
||
|
||
The method by which IPv6 nodes that use DHCP to obtain other
|
||
configuration information can obtain other configuration information
|
||
upon receipt of a Router Advertisement with the 'O' flag set is
|
||
described in Section 5.5.3 of RFC 2462.
|
||
|
||
Those IPv6 nodes that use DHCP to obtain other configuration
|
||
information initiate DHCP for other configuration information upon
|
||
receipt of a Router Advertisement with the 'O' flag set, as described
|
||
in Section 5.5.3 of RFC 2462. Those IPv6 nodes that do not use DHCP
|
||
for other configuration information can ignore the 'O' flag in Router
|
||
Advertisements.
|
||
|
||
An IPv6 node can use the subset of DHCP (described in [RFC-3736]) to
|
||
obtain other configuration information.
|
||
|
||
5.3.3. Use of Router Advertisements in Managed Environments
|
||
|
||
Nodes using the Dynamic Host Configuration Protocol for IPv6 (DHCPv6)
|
||
are expected to determine their default router information and on-
|
||
link prefix information from received Router Advertisements.
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 9]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
6. IPv4 Support and Transition
|
||
|
||
IPv6 nodes MAY support IPv4.
|
||
|
||
6.1. Transition Mechanisms
|
||
|
||
6.1.1. Transition Mechanisms for IPv6 Hosts and Routers - RFC 2893
|
||
|
||
If an IPv6 node implements dual stack and tunneling, then [RFC-4213]
|
||
MUST be supported.
|
||
|
||
7. Mobile IP
|
||
|
||
The Mobile IPv6 [RFC-3775] specification defines requirements for the
|
||
following types of nodes:
|
||
|
||
- mobile nodes
|
||
|
||
- correspondent nodes with support for route optimization
|
||
|
||
- home agents
|
||
|
||
- all IPv6 routers
|
||
|
||
Hosts MAY support mobile node functionality described in Section 8.5
|
||
of [RFC-3775], including support of generic packet tunneling [RFC-
|
||
2473] and secure home agent communications [RFC-3776].
|
||
|
||
Hosts SHOULD support route optimization requirements for
|
||
correspondent nodes described in Section 8.2 of [RFC-3775].
|
||
|
||
Routers SHOULD support the generic mobility-related requirements for
|
||
all IPv6 routers described in Section 8.3 of [RFC-3775]. Routers MAY
|
||
support the home agent functionality described in Section 8.4 of
|
||
[RFC-3775], including support of [RFC-2473] and [RFC-3776].
|
||
|
||
8. Security
|
||
|
||
This section describes the specification of IPsec for the IPv6 node.
|
||
|
||
8.1. Basic Architecture
|
||
|
||
Security Architecture for the Internet Protocol [RFC-4301] MUST be
|
||
supported.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 10]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
8.2. Security Protocols
|
||
|
||
ESP [RFC-4303] MUST be supported. AH [RFC-4302] MUST be supported.
|
||
|
||
8.3. Transforms and Algorithms
|
||
|
||
Current IPsec RFCs specify the support of transforms and algorithms
|
||
for use with AH and ESP: NULL encryption, DES-CBC, HMAC-SHA-1-96, and
|
||
HMAC-MD5-96. However, "Cryptographic Algorithm Implementation
|
||
Requirements For ESP And AH" [RFC-4305] contains the current set of
|
||
mandatory to implement algorithms for ESP and AH. It also specifies
|
||
algorithms that should be implemented because they are likely to be
|
||
promoted to mandatory at some future time. IPv6 nodes SHOULD conform
|
||
to the requirements in [RFC-4305], as well as the requirements
|
||
specified below.
|
||
|
||
Since ESP encryption and authentication are both optional, support
|
||
for the NULL encryption algorithm [RFC-2410] and the NULL
|
||
authentication algorithm [RFC-4303] MUST be provided to maintain
|
||
consistency with the way these services are negotiated. However,
|
||
while authentication and encryption can each be NULL, they MUST NOT
|
||
both be NULL. The NULL encryption algorithm is also useful for
|
||
debugging.
|
||
|
||
The DES-CBC encryption algorithm [RFC-2405] SHOULD NOT be supported
|
||
within ESP. Security issues related to the use of DES are discussed
|
||
in [DESDIFF], [DESINT], and [DESCRACK]. DES-CBC is still listed as
|
||
required by the existing IPsec RFCs, but updates to these RFCs will
|
||
be published in the near future. DES provides 56 bits of protection,
|
||
which is no longer considered sufficient.
|
||
|
||
The use of the HMAC-SHA-1-96 algorithm [RFC-2404] within AH and ESP
|
||
MUST be supported. The use of the HMAC-MD5-96 algorithm [RFC-2403]
|
||
within AH and ESP MAY also be supported.
|
||
|
||
The 3DES-CBC encryption algorithm [RFC-2451] does not suffer from the
|
||
same security issues as DES-CBC, and the 3DES-CBC algorithm within
|
||
ESP MUST be supported to ensure interoperability.
|
||
|
||
The AES-128-CBC algorithm [RFC-3602] MUST also be supported within
|
||
ESP. AES-128 is expected to be a widely available, secure, and
|
||
efficient algorithm. While AES-128-CBC is not required by the
|
||
current IPsec RFCs, it is expected to become required in the future.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 11]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
8.4. Key Management Methods
|
||
|
||
An implementation MUST support the manual configuration of the
|
||
security key and SPI. The SPI configuration is needed in order to
|
||
delineate between multiple keys.
|
||
|
||
Key management SHOULD be supported. Examples of key management
|
||
systems include IKEv2 [RFC-4306] and Kerberos; S/MIME and TLS include
|
||
key management functions.
|
||
|
||
Where key refresh, anti-replay features of AH and ESP, or on-demand
|
||
creation of Security Associations (SAs) is required, automated keying
|
||
MUST be supported.
|
||
|
||
Key management methods for multicast traffic are also being worked on
|
||
by the MSEC WG.
|
||
|
||
9. Router-Specific Functionality
|
||
|
||
This section defines general host considerations for IPv6 nodes that
|
||
act as routers. Currently, this section does not discuss routing-
|
||
specific requirements.
|
||
|
||
9.1. General
|
||
|
||
9.1.1. IPv6 Router Alert Option - RFC 2711
|
||
|
||
The IPv6 Router Alert Option [RFC-2711] is an optional IPv6 Hop-by-
|
||
Hop Header that is used in conjunction with some protocols (e.g.,
|
||
RSVP [RFC-2205] or MLD [RFC-2710]). The Router Alert option will
|
||
need to be implemented whenever protocols that mandate its usage are
|
||
implemented. See Section 4.6.
|
||
|
||
9.1.2. Neighbor Discovery for IPv6 - RFC 2461
|
||
|
||
Sending Router Advertisements and processing Router Solicitation MUST
|
||
be supported.
|
||
|
||
10. Network Management
|
||
|
||
Network Management MAY be supported by IPv6 nodes. However, for IPv6
|
||
nodes that are embedded devices, network management may be the only
|
||
possible way of controlling these nodes.
|
||
|
||
10.1. Management Information Base Modules (MIBs)
|
||
|
||
The following two MIBs SHOULD be supported by nodes that support an
|
||
SNMP agent.
|
||
|
||
|
||
|
||
Loughney Informational [Page 12]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
10.1.1. IP Forwarding Table MIB
|
||
|
||
IP Forwarding Table MIB [RFC-4292] SHOULD be supported by nodes that
|
||
support an SNMP agent.
|
||
|
||
10.1.2. Management Information Base for the Internet Protocol (IP)
|
||
|
||
IP MIB [RFC-4293] SHOULD be supported by nodes that support an SNMP
|
||
agent.
|
||
|
||
11. Security Considerations
|
||
|
||
This document does not affect the security of the Internet, but
|
||
implementations of IPv6 are expected to support a minimum set of
|
||
security features to ensure security on the Internet. "IP Security
|
||
Document Roadmap" [RFC-2411] is important for everyone to read.
|
||
|
||
The security considerations in RFC 2460 state the following:
|
||
|
||
The security features of IPv6 are described in the Security
|
||
Architecture for the Internet Protocol [RFC-2401].
|
||
|
||
RFC 2401 has been obsoleted by RFC 4301, therefore refer RFC 4301 for
|
||
the security features of IPv6.
|
||
|
||
12. References
|
||
|
||
12.1. Normative References
|
||
|
||
[RFC-1035] Mockapetris, P., "Domain names - implementation and
|
||
specification", STD 13, RFC 1035, November 1987.
|
||
|
||
[RFC-1981] McCann, J., Deering, S., and J. Mogul, "Path MTU
|
||
Discovery for IP version 6", RFC 1981, August 1996.
|
||
|
||
[RFC-2104] Krawczyk, H., Bellare, M., and R. Canetti, "HMAC:
|
||
Keyed-Hashing for Message Authentication", RFC 2104,
|
||
February 1997.
|
||
|
||
[RFC-2119] Bradner, S., "Key words for use in RFCs to Indicate
|
||
Requirement Levels", BCP 14, RFC 2119, March 1997.
|
||
|
||
[RFC-2403] Madson, C. and R. Glenn, "The Use of HMAC-MD5-96
|
||
within ESP and AH", RFC 2403, November 1998.
|
||
|
||
[RFC-2404] Madson, C. and R. Glenn, "The Use of HMAC-SHA-1-96
|
||
within ESP and AH", RFC 2404, November 1998.
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 13]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
[RFC-2405] Madson, C. and N. Doraswamy, "The ESP DES-CBC Cipher
|
||
Algorithm With Explicit IV", RFC 2405, November 1998.
|
||
|
||
[RFC-2410] Glenn, R. and S. Kent, "The NULL Encryption Algorithm
|
||
and Its Use With IPsec", RFC 2410, November 1998.
|
||
|
||
[RFC-2411] Thayer, R., Doraswamy, N., and R. Glenn, "IP Security
|
||
Document Roadmap", RFC 2411, November 1998.
|
||
|
||
[RFC-2451] Pereira, R. and R. Adams, "The ESP CBC-Mode Cipher
|
||
Algorithms", RFC 2451, November 1998.
|
||
|
||
[RFC-2460] Deering, S. and R. Hinden, "Internet Protocol, Version
|
||
6 (IPv6) Specification", RFC 2460, December 1998.
|
||
|
||
[RFC-2461] Narten, T., Nordmark, E., and W. Simpson, "Neighbor
|
||
Discovery for IP Version 6 (IPv6)", RFC 2461, December
|
||
1998.
|
||
|
||
[RFC-2462] Thomson, S. and T. Narten, "IPv6 Stateless Address
|
||
Autoconfiguration", RFC 2462, December 1998.
|
||
|
||
[RFC-2463] Conta, A. and S. Deering, "Internet Control Message
|
||
Protocol (ICMPv6) for the Internet Protocol Version 6
|
||
(IPv6) Specification", RFC 2463, December 1998.
|
||
|
||
[RFC-2472] Haskin, D. and E. Allen, "IP Version 6 over PPP", RFC
|
||
2472, December 1998.
|
||
|
||
[RFC-2473] Conta, A. and S. Deering, "Generic Packet Tunneling in
|
||
IPv6 Specification", RFC 2473, December 1998.
|
||
|
||
[RFC-2671] Vixie, P., "Extension Mechanisms for DNS (EDNS0)", RFC
|
||
2671, August 1999.
|
||
|
||
[RFC-2710] Deering, S., Fenner, W., and B. Haberman, "Multicast
|
||
Listener Discovery (MLD) for IPv6", RFC 2710, October
|
||
1999.
|
||
|
||
[RFC-2711] Partridge, C. and A. Jackson, "IPv6 Router Alert
|
||
Option", RFC 2711, October 1999.
|
||
|
||
[RFC-3041] Narten, T. and R. Draves, "Privacy Extensions for
|
||
Stateless Address Autoconfiguration in IPv6", RFC
|
||
3041, January 2001.
|
||
|
||
[RFC-3152] Bush, R., "Delegation of IP6.ARPA", BCP 49, RFC 3152,
|
||
August 2001.
|
||
|
||
|
||
|
||
Loughney Informational [Page 14]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
[RFC-3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins,
|
||
C., and M. Carney, "Dynamic Host Configuration
|
||
Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003.
|
||
|
||
[RFC-3363] Bush, R., Durand, A., Fink, B., Gudmundsson, O., and
|
||
T. Hain, "Representing Internet Protocol version 6
|
||
(IPv6) Addresses in the Domain Name System (DNS)", RFC
|
||
3363, August 2002.
|
||
|
||
[RFC-3484] Frye, R., Levi, D., Routhier, S., and B. Wijnen,
|
||
"Coexistence between Version 1, Version 2, and Version
|
||
3 of the Internet-standard Network Management
|
||
Framework", BCP 74, RFC 3584, August 2003.
|
||
|
||
[RFC-3513] Hinden, R. and S. Deering, "Internet Protocol Version
|
||
6 (IPv6) Addressing Architecture", RFC 3513, April
|
||
2003.
|
||
|
||
[RFC-3590] Haberman, B., "Source Address Selection for the
|
||
Multicast Listener Discovery (MLD) Protocol", RFC
|
||
3590, September 2003.
|
||
|
||
[RFC-3596] Thomson, S., Huitema, C., Ksinant, V., and M. Souissi,
|
||
"DNS Extensions to Support IP Version 6", RFC 3596,
|
||
October 2003.
|
||
|
||
[RFC-3602] Frankel, S., Glenn, R., and S. Kelly, "The AES-CBC
|
||
Cipher Algorithm and Its Use with IPsec", RFC 3602,
|
||
September 2003.
|
||
|
||
[RFC-3775] Johnson, D., Perkins, C., and J. Arkko, "Mobility
|
||
Support in IPv6", RFC 3775, June 2004.
|
||
|
||
[RFC-3776] Arkko, J., Devarapalli, V., and F. Dupont, "Using
|
||
IPsec to Protect Mobile IPv6 Signaling Between Mobile
|
||
Nodes and Home Agents", RFC 3776, June 2004.
|
||
|
||
[RFC-3810] Vida, R. and L. Costa, "Multicast Listener Discovery
|
||
Version 2 (MLDv2) for IPv6", RFC 3810, June 2004.
|
||
|
||
[RFC-3879] Huitema, C. and B. Carpenter, "Deprecating Site Local
|
||
Addresses", RFC 3879, September 2004.
|
||
|
||
[RFC-4292] Haberman, B., "IP Forwarding Table MIB", RFC 4292,
|
||
April 2006.
|
||
|
||
[RFC-4293] Routhier, S., Ed., "Management Information Base for
|
||
the Internet Protocol (IP)", RFC 4293, April 2006.
|
||
|
||
|
||
|
||
Loughney Informational [Page 15]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
[RFC-4301] Kent, S. and R. Atkinson, "Security Architecture for
|
||
the Internet Protocol", RFC 4301, December 2005.
|
||
|
||
[RFC-4302] Kent, S., "IP Authentication Header", RFC 4302,
|
||
December 2005.
|
||
|
||
[RFC-4303] Kent, S., "IP Encapsulating Security Payload (ESP)",
|
||
RFC 4303, December 2005.
|
||
|
||
[RFC-4305] Eastlake 3rd, D., "Cryptographic Algorithm
|
||
Implementation Requirements for Encapsulating Security
|
||
Payload (ESP) and Authentication Header (AH)", RFC
|
||
4305, December 2005.
|
||
|
||
12.2. Informative References
|
||
|
||
[DESDIFF] Biham, E., Shamir, A., "Differential Cryptanalysis of
|
||
DES-like cryptosystems", Journal of Cryptology Vol 4,
|
||
Jan 1991.
|
||
|
||
[DESCRACK] Cracking DES, O'Reilly & Associates, Sebastapol, CA
|
||
2000.
|
||
|
||
[DESINT] Bellovin, S., "An Issue With DES-CBC When Used Without
|
||
Strong Integrity", Proceedings of the 32nd IETF,
|
||
Danvers, MA, April 1995.
|
||
|
||
[IPv6-RH] P. Savola, "Security of IPv6 Routing Header and Home
|
||
Address Options", Work in Progress.
|
||
|
||
[RFC-793] Postel, J., "Transmission Control Protocol", STD 7,
|
||
RFC 793, September 1981.
|
||
|
||
[RFC-1034] Mockapetris, P., "Domain names - concepts and
|
||
facilities", STD 13, RFC 1034, November 1987.
|
||
|
||
[RFC-2205] Braden, R., Zhang, L., Berson, S., Herzog, S., and S.
|
||
Jamin, "Resource ReSerVation Protocol (RSVP) --
|
||
Version 1 Functional Specification", RFC 2205,
|
||
September 1997.
|
||
|
||
[RFC-2464] Crawford, M., "Transmission of IPv6 Packets over
|
||
Ethernet Networks", RFC 2464, December 1998.
|
||
|
||
[RFC-2492] Armitage, G., Schulter, P., and M. Jork, "IPv6 over
|
||
ATM Networks", RFC 2492, January 1999.
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 16]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
[RFC-2675] Borman, D., Deering, S., and R. Hinden, "IPv6
|
||
Jumbograms", RFC 2675, August 1999.
|
||
|
||
[RFC-4213] Nordmark, E. and R. Gilligan, "Basic Transition
|
||
Mechanisms for IPv6 Hosts and Routers", RFC 4213,
|
||
October 2005.
|
||
|
||
[RFC-3569] Bhattacharyya, S., "An Overview of Source-Specific
|
||
Multicast (SSM)", RFC 3569, July 2003.
|
||
|
||
[RFC-3736] Droms, R., "Stateless Dynamic Host Configuration
|
||
Protocol (DHCP) Service for IPv6", RFC 3736, April
|
||
2004.
|
||
|
||
[RFC-4001] Daniele, M., Haberman, B., Routhier, S., and J.
|
||
Schoenwaelder, "Textual Conventions for Internet
|
||
Network Addresses", RFC 4001, February 2005.
|
||
|
||
[RFC-4033] Arends, R., Austein, R., Larson, M., Massey, D., and
|
||
S. Rose, "DNS Security Introduction and Requirements",
|
||
RFC 4033, March 2005.
|
||
|
||
[RFC-4034] Arends, R., Austein, R., Larson, M., Massey, D., and
|
||
S. Rose, "Resource Records for the DNS Security
|
||
Extensions", RFC 4034, March 2005.
|
||
|
||
[RFC-4035] Arends, R., Austein, R., Larson, M., Massey, D., and
|
||
S. Rose, "Protocol Modifications for the DNS Security
|
||
Extensions", RFC 4035, March 2005.
|
||
|
||
[RFC-4306] Kaufman, C., Ed., "Internet Key Exchange (IKEv2)
|
||
Protocol", RFC 4306, December 2005.
|
||
|
||
[SSM-ARCH] H. Holbrook, B. Cain, "Source-Specific Multicast for
|
||
IP", Work in Progress.
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 17]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
13. Authors and Acknowledgements
|
||
|
||
This document was written by the IPv6 Node Requirements design team:
|
||
|
||
Jari Arkko
|
||
[jari.arkko@ericsson.com]
|
||
|
||
Marc Blanchet
|
||
[marc.blanchet@viagenie.qc.ca]
|
||
|
||
Samita Chakrabarti
|
||
[samita.chakrabarti@eng.sun.com]
|
||
|
||
Alain Durand
|
||
[alain.durand@sun.com]
|
||
|
||
Gerard Gastaud
|
||
[gerard.gastaud@alcatel.fr]
|
||
|
||
Jun-ichiro itojun Hagino
|
||
[itojun@iijlab.net]
|
||
|
||
Atsushi Inoue
|
||
[inoue@isl.rdc.toshiba.co.jp]
|
||
|
||
Masahiro Ishiyama
|
||
[masahiro@isl.rdc.toshiba.co.jp]
|
||
|
||
John Loughney
|
||
[john.loughney@nokia.com]
|
||
|
||
Rajiv Raghunarayan
|
||
[raraghun@cisco.com]
|
||
|
||
Shoichi Sakane
|
||
[shouichi.sakane@jp.yokogawa.com]
|
||
|
||
Dave Thaler
|
||
[dthaler@windows.microsoft.com]
|
||
|
||
Juha Wiljakka
|
||
[juha.wiljakka@Nokia.com]
|
||
|
||
The authors would like to thank Ran Atkinson, Jim Bound, Brian
|
||
Carpenter, Ralph Droms, Christian Huitema, Adam Machalek, Thomas
|
||
Narten, Juha Ollila, and Pekka Savola for their comments.
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 18]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
Editor's Contact Information
|
||
|
||
Comments or questions regarding this document should be sent to the
|
||
IPv6 Working Group mailing list (ipv6@ietf.org) or to:
|
||
|
||
John Loughney
|
||
Nokia Research Center
|
||
Itamerenkatu 11-13
|
||
00180 Helsinki
|
||
Finland
|
||
|
||
Phone: +358 50 483 6242
|
||
EMail: John.Loughney@Nokia.com
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 19]
|
||
|
||
RFC 4294 IPv6 Node Requirements April 2006
|
||
|
||
|
||
Full Copyright Statement
|
||
|
||
Copyright (C) The Internet Society (2006).
|
||
|
||
This document is subject to the rights, licenses and restrictions
|
||
contained in BCP 78, and except as set forth therein, the authors
|
||
retain all their rights.
|
||
|
||
This document and the information contained herein are provided on an
|
||
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
|
||
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
|
||
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
|
||
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
|
||
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
|
||
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
|
||
|
||
Intellectual Property
|
||
|
||
The IETF takes no position regarding the validity or scope of any
|
||
Intellectual Property Rights or other rights that might be claimed to
|
||
pertain to the implementation or use of the technology described in
|
||
this document or the extent to which any license under such rights
|
||
might or might not be available; nor does it represent that it has
|
||
made any independent effort to identify any such rights. Information
|
||
on the procedures with respect to rights in RFC documents can be
|
||
found in BCP 78 and BCP 79.
|
||
|
||
Copies of IPR disclosures made to the IETF Secretariat and any
|
||
assurances of licenses to be made available, or the result of an
|
||
attempt made to obtain a general license or permission for the use of
|
||
such proprietary rights by implementers or users of this
|
||
specification can be obtained from the IETF on-line IPR repository at
|
||
http://www.ietf.org/ipr.
|
||
|
||
The IETF invites any interested party to bring to its attention any
|
||
copyrights, patents or patent applications, or other proprietary
|
||
rights that may cover technology that may be required to implement
|
||
this standard. Please address the information to the IETF at
|
||
ietf-ipr@ietf.org.
|
||
|
||
Acknowledgement
|
||
|
||
Funding for the RFC Editor function is provided by the IETF
|
||
Administrative Support Activity (IASA).
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
Loughney Informational [Page 20]
|
||
|