From sac-owner Wed Apr 9 16:47:16 2008 Received: from sunmail3mpk.sfbay.sun.com (sunmail3mpk.SFBay.Sun.COM [129.146.11.52]) by sac.sfbay.sun.com (8.13.8+Sun/8.13.8) with ESMTP id m39NlGRC010791 for ; Wed, 9 Apr 2008 16:47:16 -0700 (PDT) Received: from sunmail3mpk.sfbay.sun.com (localhost [127.0.0.1]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m39NlG9V001457 for ; Wed, 9 Apr 2008 16:47:16 -0700 (PDT) Received: (from noaccess@localhost) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/Submit) id m39NlGgh001453 for one-pager-not-2b-used-directly; Wed, 9 Apr 2008 16:47:16 -0700 (PDT) Received: from brm-avmta-1.central.sun.com (brm-avmta-1.Central.Sun.COM [129.147.4.11]) by sunmail3mpk.sfbay.sun.com (8.13.7+Sun/8.13.7/ENSMAIL,v2.2) with ESMTP id m39NlECZ001414; Wed, 9 Apr 2008 16:47:15 -0700 (PDT) Received: from pmxchannel-daemon.brm-avmta-1.central.sun.com by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) id <0JZ30051X0QQO500@brm-avmta-1.central.sun.com>; Wed, 09 Apr 2008 17:47:14 -0600 (MDT) Received: from localhost.east.sun.com ([10.7.251.192]) by brm-avmta-1.central.sun.com (Sun Java System Messaging Server 6.2-3.04 (built Jul 15 2005)) with ESMTP id <0JZ3009490QMR0E0@brm-avmta-1.central.sun.com>; Wed, 09 Apr 2008 17:47:11 -0600 (MDT) Received: from localhost.east.sun.com (localhost [127.0.0.1]) by localhost.east.sun.com (8.14.2+Sun/8.14.2) with ESMTP id m39NlA7k002567; Wed, 09 Apr 2008 19:47:10 -0400 (EDT) Received: (from sommerfeld@localhost) by localhost.east.sun.com (8.14.2+Sun/8.14.2/Submit) id m39NlA4K002566; Wed, 09 Apr 2008 16:47:10 -0700 (PDT) Date: Wed, 09 Apr 2008 19:47:09 -0400 From: Bill Sommerfeld Subject: [2008/252]Labeled IPsec phase 1 To: one-pager@Sun.Com Cc: ipsec-core , Jennifer Bauer Message-id: <1207784830.1903.41.camel@localhost> MIME-version: 1.0 X-Mailer: Evolution 2.12.2 Content-type: text/plain Content-transfer-encoding: 7BIT X-PMX-Version: 5.4.1.325704 X-Authentication-warning: localhost.east.sun.com: sommerfeld set sender to sommerfeld@sun.com using -f Status: RO Content-Length: 7654 Template Version: @(#)onepager.txt 1.35 07/11/07 SMI Copyright 2007 Sun Microsystems 1. Introduction 1.1. Project/Component Working Name: Labeled IPsec phase 1 1.2. Name of Document Author/Supplier: Bill Sommerfeld 1.3. Date of This Document: 3/12/2008 1.3.1. Date this project was conceived: CY07Q1 (approximately) 1.4. Name of Major Document Customer(s)/Consumer(s): 1.4.1. The PAC or CPT you expect to review your project: Solaris PAC 1.4.2. The ARC(s) you expect to review your project: PSARC 1.4.3. The Director/VP who is "Sponsoring" this project: Kathy Jenks 1.4.4. The name of your business unit: New Solaris 1.5. Email Aliases: 1.5.1. Responsible Manager: Steve.DeTar@sun.com 1.5.2. Responsible Engineer: William.Sommerfeld@sun.com 1.5.3. Marketing Manager: Mark.Thacker@sun.com 1.5.4. Interest List: security-discuss@opensolaris.org 2. Project Summary 2.1. Project Description: The current labeled networking technologies in Trusted Extensions assume that the underlying network will not misroute or manipulate packets in flight between parties. This project proposes to augment labeled networking to allow IPsec to be used instead of or in addition to the existing CIPSO security option, with the IPsec SADB augmented to associate sensitivity labels with each security association. 2.2. Risks and Assumptions: We have limited visiblity into the requirements of organizations currently using Trusted Extensions; phase 1 is in part intended to get people to talk to us about their needs in this space. 3. Business Summary 3.1. Problem Area: Allows labeled networking to be used over untrusted wires. 3.2. Market/Requester: Customers in this space are those seeking to secure their environment against hostile internal and external attacks. Labeled networking may become relevant to many more customers if it makes fewer assumptions about the security of the underlying network. Common routers drop CIPSO-labeled traffic in their default configuration; CIPSO-labeled networking cannot be deployed without touching every single router in the network. 3.3. Business Justification: 3.4. Competitive Analysis: SELinux has its own interpretation of labeled IPsec, which is closely tied to the SElinux concept of security contexts. Multi-label interoperability with SElinux seems unlikely; single-label interop may be possible. 3.5. Opportunity Window/Exposure: 3.6. How will you know when you are done?: // What will you measure to determine that the project is complete? // // This section is for explicit measurable customer CTQs that apply // to this specific feature proposal, not to the product as a whole. // // We *expect* every development team to meet their Feature, // Performance and Security and Testing goals, as well as getting // all required ARC and PAC review approvals, so don't put that // sort of metric here. IPsec-protected Labeled networking can be used to protect application traffic on the wire both with and without CIPSO between multiple TX systems and (at a single label per remote system) with non-TX systems. 4. Technical Description: 4.1. Details: The existing labeled networking found in TX uses CIPSO, which places sensitivity labels in unprotected cleartext IP options. As a result, anyone with access to the raw network wire can observe and manipulate the sensitivity label of packets in flight. IKE version 1 contains a protocol feature to exchange sensitivity labels; we can use that feature in order to associate sensitivity labels with IPsec security associations, and both cryptographically bind a label to the traffic protected under a particular key, and obscure the exact label of traffic from the view of eavesdroppers. We will extend the IPsec SADB to associate labels and other new properties with each security association, and will extend in.iked to permit those properties to be configured. 4.2. Bug/RFE Number(s): TBD 4.3. In Scope: Single-label interoperability with non-TX systems. 4.4. Out of Scope: No changes to the TX networking databases (tnrhdb, tnrhtp) are in-scope for this phase of the project; the existing database format will be used for storing label ranges only. This phase is not expected to be particularly useful for mobile hosts as clearances, etc., will continue to be associated with individual IP addresses. Secure distribution of security attributes/context other than the TX sensitivity label are out of scope for this phase. 4.5. Interfaces: This project will compatibly extend the PF_KEY interface as necessary to manipulate new SA parameters, and will extend the IKE configuration interfacefile format similarly. 4.6. Doc Impact: New and updated manpages for utilities. Updated section in Administration Guide. 4.7. Admin/Config Impact: A default installation will not configurate, enable, or be otherwise affected by this project. If both trusted networking and IPsec are configured, several new options will be available within in.iked's config file. 4.8. HA Impact: None expected. 4.9. I18N/L10N Impact: Minimal impact to I18N/L10N (a few new error messages may need to be translated). 4.10. Packaging & Delivery: No new packages or files are expected; existing binaries and config files will be extended to include the new functionality. 4.11. Security Impact: Provides a higher-security alternative to CIPSO labels for labeled networking, making labeled networking relevant in additional configurations. // How does this proposal interact with security-related APIs // or interfaces? Does it rely on any Java policy or platform // user/permissions implication? If the feature exposes any // new ports, listeners, or any similar communication points // which may have security implications, note these here. 4.12. Dependencies: At this time it appears that all necessary dependencies have integrated in Nevada. 5. Reference Documents: // List of related documents, if any (BugID's, RFP's, papers). // Explain how/where to obtain the documents, and what each // contains, not just their titles. Identify any related projects // (by ID or case number, if possible). 6. Resources and Schedule: 6.1. Projected Availability: Public Prototype: CY08Q2 Design Review: CY08Q2 Code Complete: CY08Q4 Putback: CY08Q4 6.2. Cost of Effort: 1 Development FTE for one years 1 Project Manager, 20% for one years 1 Documentation FTE for 3 months 1 Test FTE for 3 months 6.3. Cost of Capital Resources: N/A. Can be done with existing lab resources 6.4. Product Approval Committee requested information: 6.4.1. Consolidation or Component Name: ON 6.4.3. Type of CPT Review and Approval expected: FastTrack 6.4.4. Project Boundary Conditions: // Give the document's URL http://.... TBD 6.4.5. Is this a necessary project for OEM agreements: // if Yes, give references No 6.4.6. Notes: N/A 6.4.7. Target RTI Date/Release: CY08Q4 6.4.8. Target Code Design Review Date: Design Review CY08Q2 6.4.9. Update approval addition: N/A 6.5. ARC review type: Standard 6.6. ARC Exposure: open 6.6.1. Rationale: Some code will be closed (libike/iked) but design will be open. 7. Prototype Availability: 7.1. Prototype Availability: CY08Q2 7.2. Prototype Cost: 50%