IPv6 and IPSec - why do I need an external daemon?

Question

I read that IPSec is mandatory for IPv6 implementations. Does this mean that it should be handled by the OS and that IPSec configuration should be mandatory for IPv6 to work? If so, why is this not the case? I have a working 6-in-4 tunnel set up between two Ubuntu machines, and IPv6 seems to be perfectly happy without IPSec configured/working.

Also, I read that for Ubuntu, IPSec for IPv6 can be configured using external software (racoon?). Why is IPSec not mandatory to use with Ubuntu's IPv6 implementation?

Answer 1

It is mandatory for implementations to support IPSec for IPv6, but it is not mandatory to enable it. And even the mandatory (MUST in IETF language) is being changed to a very strong recommendation (SHOULD in IETF language, i.e. implement unless you have a very good reason not to) in the latest RFC updates.

The big problem with security is that it is impossible to do fully automatically. If it was, then anybody could automatically join in ;-) Setting up a system for managing public/private keys, certificates etc (PKI: Public Key Infrastructure) is always the challenge when doing this kind of security.

PS: that IPSec is required doesn't say anything about where it is implemented. IPSec being implemented in a separate package still means that the whole complies to the standards.

Answer 2

IPSec support is mandated at the protocol level. Implementation and usage are not.

Answer 3

why do I need an external daemon?

The Linux kernel supports IPsec in that it can automatically and transparently encrypt/decrypt ESP packets, or add/verify AD headers, when given the encryption keys.

However, you still need software that would manage those encryption keys – this is where Racoon or StrongSwan come in. They take care of authentication and key exchange (IKE, IKEv2, Kerberos); they maintain the key assignments (static key for host X, an X.509 cert for host Y); they tell the kernel about new and dropped security associations. Doing all these operations in user-space increases security and reliability, and allows new authentication or key-exchange protocols without having to rebuild the kernel. In addition, many of these protocols already have well-tested implementations in user-space; doing everything in the kernel would require duplicating a lot of code.