IPv6 Ready Logo Program Phase-2 IPsec

last update Oct. 15, 2007

Requirement

• Security Protocol:
  
  NUT has to pass all the tests of ESP regardless the type of the NUT.
  The IPv6 Ready Logo Program does not focus on AH.
  
  
  
• Mode:
  
  The mode requirement depends on the type of NUT.
  
  
  • Host:
    NUT has to pass all the tests of transport mode and optionally Tunnel mode.
    
    
  • Security Gateway(SGW):
    NUT has to pass all the tests of Tunnel mode.
    
  
  
  
• Encryption Algorithm:
  
  We defined two categories for Encryption Algorithms.
  
  
  • BASE ALGORITHM:
    To obtain the Logo for IPsec, all NUT must pass the tests for BASIC ALGORITHM.
    
    • 3DES-CBC
      
    
    
  • ADVANCED ALGORITHM:
    If a NUT supports some algorithms which are listed in ADVANCED ALGORITHM, it has to pass the tests for the algorithms.
    
    • AES-CBC
      
    • AES-CTR
      
    • NULL
      
  
  
  
• Authentication Algorithm:
  
  We defined two categories for Authentication Algorithms.
  
  
  • BASE ALGORITHM:
    To obtain the Logo for IPsec, all NUT must pass the tests for BASIC ALGORITHM.
    
    • HMAC-SHA1
      
    
    
  • ADVANCED ALGORITHM:
    If a NUT supports some algorithms, which are listed in ADVANCED ALGORITHM, it has to pass the tests for the algorithms.
    
    • AES-XCBC
      
    • NULL
      

Self-Test Specification

Please visit IPv6 Ready Logo Program Web Page.

Test Suite

• Platform

  Please download the latest version of v6eval. (requires version 3.0.12 or higher)
  
  

• Scripts

  • For End-Node and Security Gateway
    
    
    • IPsec_Self_Test_P2 (version 1.1.2) Oct. 15, 2007
      
      MD5 (IPsec_Self_Test_P2_1-1-2.tgz) = b831ea6cf02eccab69e59d2be4b9a02a

      CHANGELOG
      

    
    When you extract tarball,
    you can find the directory named ${somewhere}/IPsec_Self_Test_P2_X-X-X/ipsec.p2
    
    After the configuration as described in INSTALL.ct,
    change working directory to ${somewhere}/IPsec_Self_Test_P2_1-1-2
    
    
    Configure the ipsec.p2/p2_ipsec_config for your device.
    

    You can specify the Encription and Authentication algorithm
    which you support as well as functions and waiting time.
    At least you need to specify your device type (End-Node or SGW)
    By default it runs for End-Node.
    

    
    Then type "make ipv6ready_p2_end_node" (for End-Node) or "make ipv6ready_p2_sgw" (for Router).
    
    By default, it uses ICMP for test.
    If you need to use UDP you can use udp by typing "make ipv6ready_p2_end_node_udp" (for End-Node) or "make ipv6ready_p2_sgw_udp" (for Router)".
    
  
  

• Test Results

  As a Self-test result, we need whole "IPsec_Self_Test_P2_X-X-X" directory where you run.
  Please send this directory without any modification with interoperability test result in tar.gz format.
  
  e.g.,)
  

  Make directries like this.
  

  ${Your_Device_ver}/IPsec_Self_Test_P2_X-X-X/
  ${Your_Device_ver}/Interoperability/
  

  RUN command like following.
  

  > tar zcvf $Your_Device_ver.tar.gz $Your_Device_ver

• Self-Test Sample Result (Self-test Ver. 1.0.7)

  • For End-Node

    FreeBSD 5.4-RELEASE-p8

  • For SGW

    TBD
    

    
    
  
  

Interopearability Test Scenario

Please visit IPv6 Ready Logo Program Web Page.

IPv6 Forum, IPv6 Logo Comittee