E-Library_NIST.SP.500-281A_R1.pdf

NIST Special Publication 500-281A

Revision 1

USGv6 Test Program Guide

Doug Montgomery

Erica Johnson

Michayla Newcombe

Timothy Winters

This publication is available free of charge from:

https://doi.org/10.6028/NIST.SP.500-281Ar1

Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and

Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This document reports on

ITL’s research, guidance, and outreach efforts in Information Technology and its collaborative activities with industry, government, and academic organizations.

DISCLAIMER

This document has been prepared by the National Institute of Standards and Technology

(NIST) and describes standards research in support of the Federal IPv6 Program. Certain commercial entities, equipment, or material may be identified in this document in order to describe a concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that these entities, materials, or equipment are necessarily the best available for the purpose.

Nothing in this document is intended to contradict standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority, nor ought this profile to be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the Office of Management and

Budget, or any other Federal official.

National Institute of Standards and Technology Special Publication 500-281Ar1

Natl. Inst. Stand. Technol. Spec. Publ. 500-281Ar1, 16 pages (November 2020)

CODEN: NSPUE2

This publication is available free of charge from:

i

T h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

A r1

Executive Summary

The Office of Management and Budget (OMB) directed [OMB-21-07, OMB-IPv6, OMB-

M05-22] the National Institute of Standards and Technology (NIST) to develop the technical infrastructure (standards and testing) necessary to support wide scale adoption of Internet

Protocol version 6 (IPv6) in the US Government (USG). In response, NIST developed the initial USGv6 Profile [SP500-267] to assist agencies in the development of acquisition requirements for IPv6 products and the USGv6 Test Program [SP500-281] to provide the means to assess product compliance to such requirements were developed to meet the goals of the directive. In subsequent years additional USG policies [OMB-M21-07, OMB-IPv6, FAR-2005-041, OMB-M17-06] referred to these USGv6 programs.

In 2020 NIST undertook a significant revision of the USGv6 Profiles and Test Program to update their technical specifications and to streamline their use in Federal procurement processes. This document reflects the changes made to the Test Program as part of that revision process. Full details on this revision to the USGv6 Program can be found at the program’s web site [USGv6-Web].

This document outlines the form and function of the USGv6 Test Program. In particular, it defines the components of the test program, their implementation and use. This guide also defines the management process that will govern the future evolution of the test program and how it will address and accommodate ever changing requirement sets and product offerings.

This document outlines the technical infrastructure provided by the USGv6 Test Program and how it is to be used by each of the groups below.

• Product developers aiming to document IPv6 capabilities that comply with requirements expressed in terms of the USGv6 Profile;

• USG Agencies acquiring IT products that require IPv6 capabilities; and,

• USGv6 Test Program Labs that will provide testing services to support the above.

This document describes a specific programmatic use of the USGv6 Profile and supporting

USGv6 Test Program to support deployment initiatives in the USG. While designed to support USG use, it is expected that other user groups can leverage this test program / document either directly or through simple derivative works. All such leverage and reuse of this program by other efforts is highly encouraged and the USGv6 Test Program will work to support and harmonize with such efforts to the maximum extent possible.

This document is not subject to copyright and its voluntary reuse, either in its entirety, or in derivative works is encouraged. References to this specification should cite:

• “USGv6 Test Program Guide”, NIST Special Publication 500-281A revision 1, National Institute of Standards and Technology, November 2020, ii h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Abstract defines the components of the test program, their implementation and use. This guide also defines the management process that will govern the future evolution of the test program and how it will address and accommodate ever changing requirement sets and product offerings.

Key words

Internet Protocol version 6; IPv6; standards profile; conformance testing; interoperability testing; acquisition; USGv6, USGv6 Test Program.

iii h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Table of Contents

Introduction

1.1. USGv6 Test Program

1.2. Purpose, Scope and Document Structure

1.3. Constituencies

1.3.1. Federal Agencies

1.3.2. IPv6 Product Vendors

1.3.3. Accredited Test Laboratories

1.3.4. Test Method Developers

1.3.5. Accreditors

USGv6 Test Program Elements

2.1. Artifacts

2.2. Processes

2.2.1. Testing Processes

2.2.2. Management Processes

USGv6 Test Program Element Lifecycles

Claims of Product Compliance

4.1. Preliminary Requirements

4.2. Product Requirements

4.3. Documenting Product Capabilities

4.3.1. Unitary Products

4.3.2. Composite Products

4.3.3. IPv6-only Environments

4.3.4. Multiple Stacks per Product

4.3.5. Product Families

4.4. Self-Test and Self Declarations

4.5. Traceability and Applicability of Test Results

4.6. IPv6 Product Supplier’s Process

References

Appendix A: Supplemental Materials

Appendix B: Change Log h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Introduction defines the components of the test program, their implementation and use. This guide also defines the management process that will govern the future evolution of the test program and how it will address and accommodate ever changing requirement sets and product offerings.

This document has been prepared for use in conjunction with revision 1 of the USGv6 Profile

[SP500-267Br1] and revision 1 of USGv6 Test Methods: General Description and Validation

[SP500-281Br1].

This document is not subject to copyright and its voluntary reuse by other, nongovernmental user groups, either in its entirety, or in derivative works is encouraged. References to this specification should cite:

• “USGv6 Test Program Guide”, NIST Special Publication 500-281A revision 1, National Institute of Standards and Technology, November 2020,

1.1. USGv6 Test Program

The first USG IPv6 profile, A Profile for IPv6 in the U.S. Government - Version 1.0 [SP500-

267], was published in July 2008. In 2020 NIST published a significant revision to the

USGv6 Program, including a new, restructured profile entitled USGv6 Profile. The new profile defines over 90 named IPv6 capability sets, which are further specified in terms of over 200 IPv6-related IETF specifications and other standards. The resulting named IPv6 capabilities can facilitate the definition of requirements for a vast variety of network products and services.

NIST established the USGv6 Test Program to document products’ compliance with USG

IPv6 capability requirements. The test program makes use of a set of abstract test specifications, each validated against the respective protocol specifications. To document

IPv6 capabilities, products must be tested against tools validated to these tests, in accredited laboratories. Having implemented and tested their products, suppliers must report their claims of compliance in a systematic and standardized way. The Supplier’s Declaration of

Conformity (SDoC) is a tool that offers a flexible means of constructing these claims and will be used to document compliance with stated USGv6 requirements.

The USGv6 Profile contains a wide range of specified capabilities, and the testing program includes components that are subject to enhancement and revision over time. Hence it is necessary to have in place a scheme to manage the evolution and maintenance of these components that includes collaboration with the stakeholders.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

1.2. Purpose, Scope and Document Structure

This document provides a guide to the USGv6 Test Program. It gives an overview of the elements of the program. It offers guidance to agencies on what to look for in IPv6 capable products, and to IPv6 product suppliers on how to assert their compliance with USGv6 technical requirements.

Some consequences of putting together a technical recommendation that is a compendium of large numbers of different, informal standards include:

1) Tests derived from natural language specifications are not formally derived, thereby increasing the potential for bugs; and

2) Changes standards over time may lead to complex interoperability issues and potential compatibility problems.

A result of (1) is that informally derived tests have the characteristic of software and need debugging over several iterations of use. Where tests are lacking in coverage, testing bugs and difficulties in IPv6 products can go undetected. A systematic review and revision process for tests will result in progressively increased accuracy and optimized coverage over time, with the ultimate goal of increasing confidence in product correctness and interoperability.

This document addresses the natural lifecycles of standards, tests and IPv6 products, and establishes schedules for systematic change in the selection and update of these items. It also explains the requirements for vendors use of Supplier’s Declaration of Conformity (SDoC) to document the test results for IPv6 capabilities supported by their products. The USGv6 Test

Program attempts to provide the flexibility necessary to avoid redundant retesting of IPv6 implementations that are used, unmodified, across multiple distinct product offerings. This document addresses the scenarios and specific testing and reporting requirements for products that may inherit the test results of previously tested implementations.

Following this introduction, Section 2 introduces the elements of the testing program, including artifacts, processes and stakeholders involved in the USGv6 Test Program. The interaction between stakeholders and processes is fundamental to the operation of the testing program. The lifecycles of the artifacts, and their impacts on interoperability, are explored in

Section 3, and management of the testing program is discussed in Section 2. Section 4 is devoted to the definition and operation of the SDoC.

1.3. Constituencies

This section identifies how federal agencies, IPv6 product suppliers and accredited test laboratories should use the USGv6 Test Program, including their particular uses of the

USGv6 Profile, the USGv6 testing website, and USGv6 Test Methods, together with this document.

1.3.1. Federal Agencies

A USG federal agency’s objective with respect to the USGv6 Test Program may include (1) specifying IPv6 capability requirements through RFPs, or published enterprise network h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2 architecture goals, and (2) evaluating IT product supplier offerings through examination and comparison of completed SDoCs.

(1) The USGv6 Profile provides a vocabulary through which an agency can define a set of unique IPv6 capabilities appropriate to its specific networking requirements. In addition, it recommends sets of IPv6 capabilities that should be mandatory for a variety of common networked IT products.

(2) Section 4 of this document discusses claims of product compliance and provides requirements to product suppliers on completing the SDoC. The SDoC contains claims of tested capabilities that are summarized in the Capability Summary String

(CSS) notation.

Should an Agency wish to keep active track of, and participate in, events in the USGv6 Test

Program, they are invited to join the usgv6-testing@list.nist.gov email list1.

1.3.2. IPv6 Product Vendors

Network product suppliers develop products with particular capabilities for sale to buyers including the Federal Government. Typically, the feature sets and protocols supported by a given commercial product offering are dictated by the vendors and their product development processes. When bulk or custom RFPs require it, products can be tailored to specific agency requirements. In either case, the USGv6 Test Program can be leveraged to document the tested capabilities of products in a common reporting format.

Product vendors submit mature products for testing to an USGv6 accredited testing laboratory. The SDoC captures the results of conformance, interoperability and functional tests conducted and provides traceability back to the accredited laboratory and the methods used to test. The SDoC provides the flexibility necessary to deal with the complexity of modern IT products, including different hardware and software combinations, composite products and product families.

Not all capabilities identified in the USGv6 profile have standardized test methods. Where no standardized tests currently exist, a product supplier attests that the claimed capability is fully implemented and was tested in-house.

Should a product supplier wish to keep active track of, and participate in, events in the

USGv6 Test Program, they are invited to join the usgv6-testing@list.nist.gov email list.

1.3.3. Accredited Test Laboratories

Product testing in the USGv6 program is performed by accredited testing laboratories. The accreditation program, and the use of standardized test methods and a common test reports ensures the quality and the commonality of testing results from this program.

The test program supports 1st, 2nd and 3rd party accredited test labs. A 1st party lab is associated with the product developer. A 2nd party lab is associated with a USG agency. A

3rd party lab is independent of both the vendor and the purchaser. The types of testing

1 To subscribe to this list, send an email to: usgv6-testing+subscribe@list.nist.gov.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2 permitted by each lab is defined in USGv6 Test Methods: General Description and

Validation [SP500-281Br1].

The objective of a test laboratory is to establish USGv6 Test Program accreditation, test vendor supplied products and produce laboratory test reports. While it is the product supplier’s responsibility to generate the SDoC, in practice we expect test laboratories to have the greater body of knowledge about the testing program and the profile, and to offer SDoC production assistance.

1.3.4. Test Method Developers

Commercial developers, including open source suppliers, develop IPv6 test methods based on the abstract test specifications. In conjunction with test laboratories, test method developers may take part in interlaboratory comparisons to make sure that test results for the same test, even if derived using different methods in different labs, are equivalent.

1.3.5. Accreditors

The role of an accreditor is to assess test laboratories for their compliance with “General requirements for the competence of testing and calibration laboratories” [ISO/IEC 17025].

These are the required quality provisions for test laboratories. All assessors develop programs that evaluate laboratory quality programs, technical test methods and assess technical competence. In the case of USGv6, the technical requirements are based on

“USGv6 Test Methods: General Description and Validation” [SP500-281Br1].

USGv6 Test Program Elements

The principle elements of the USGv6 Test Program are test specifications and quality control processes necessary to enable an open market for product testing while insuring consistency of results. Each of these elements is governed by a process and is subject to change in managed stages. For each element and its process, a subgroup of stakeholders has a direct interest. In this section, the set of artifacts is identified in Section 2.1. The processes associated with particular artifacts are explained in Section 2.2.

2.1. Artifacts

The NIST IPv6 Profile [SP500-267Ar1] is the document that defines sets of IPv6 capabilities that are used to develop statements of procurement requirements or to document capabilities of vendor’s products.

The USGv6 Profile [SP500-267Br1] is the document that refines the generic NIST IPv6

Profile for Federal Government use.

The USGv6 Supplier’s Declaration of Conformity (SDoC) [SP500-281Ar1s] is based on

Conformity assessment — Supplier's declaration of conformity — Part 1: General requirements [ISO/IEC 17050-1]. SDoC documents a product supplier’s claims of compliance. It contains a tabular summarization of test results for IPv6 capabilities supported h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2 by the product, expressed in terms of the USGv6 profile. Changes to SDoC arise from retesting and repackaging products.

Abstract Test Specifications are needed for conformance and interoperability tests.

Typically, a single test specification is based on an individual defined IPv6 capability, and individual tests are created with purposes specific to functions in the underlying protocol specification(s). The test specifications in use are largely the product of the IPv6 Ready Logo program [IPv6-Ready]. Some test specifications have been privately developed, e.g. by test labs such as UNH InterOperability Laboratory, some by collaboration with other organizations such as OSPFv3 by Taiwan Telecommunications Laboratories and some through USG funding. A Memoranda of Understanding [NIST-IPv6F] has been signed between NIST and the developers of these test specifications to allow the USGv6 Test

Program to make free use of them. Since these tests were developed to meet the IPv6 Ready

Logo program, they sometimes differ from the requirements of the USGv6 Profile. Where there are differences between the USGv6 and IPv6 Ready Logo tests, the Test Selection

Tables detail the USGv6 requirements.

Test Selection Tables are developed by the USGv6 Test Program, to identify a base test specification and list the abstract tests that are required to claim support for an IPv6 capability. These tables also indicate any differences between the required USGv6 test and the corresponding IPv6 Ready Logo tests. The test selections are also subject to the USGv6

Test Program’s open review process. The test selection tables are available on the USGv6

Program website [USGv6-Web].

2.2. Processes

The operation of the USGv6 Test Program is defined by its testing processes and management processes. These processes regulate the development of the artifacts, given above.

2.2.1. Testing Processes

All testing is conducted using the published USGv6 Test Program test specifications. All tests are derived from the published standards or other specifications developed through supplier and test lab collaboration. Conformance and interoperability testing typically finds bugs in products under test, but also finds bugs in the tests themselves. The tests must be validated thoroughly and converge on a single shared interpretation for each test purpose.

Functional testing allows for testing when no formal specification exist.

Conformance testing is conducted between the product under test and a test system. The test system executes tests that implement the purposes and procedures of the IPv6 abstract test specifications. Abstract tests are periodically corrected and updated, so executable tests and test systems must also be modified to maintain equivalence. There is a process of validation

(see below) that reconciles abstract and executable test specifications.

Interoperability testing is conducted among multiple independent products under test, according to abstract tests. Abstract test suites for interoperability typically include detailed h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2 test configuration information, and test procedures that are often conducted manually. These tests are also periodically corrected and updated.

Functional testing is behavioral testing when no formal specification exists to allow for conformance and interoperability testing. The test procedures are developed in collaboration with the product developer and the accredited test laboratory to verify that the product works as defined.

2.2.2. Management Processes

Abstract Test Development: The USGv6 Test Program has leveraged established tests and testing infrastructure associated with the IPv6 Ready Logo program. Once developed, tests are released to the community of labs for a review period, corrected, agreed, and published with a revision number.

Test Method Validation: The abstract test specifications need to be translated into executable test methods. The quality management process ensures that all test methods in use for each IPv6 capability generate identical results when testing the same implementation.

This equivalence is ensured through the processes of interlaboratory comparisons.

USGv6 Test Selection: Test Selection Tables are published by NIST on the USGv6 Program website [USGv6-Web]. Revisions to the Test Selection Tables are subject to public review.

Laboratory Accreditation: Accreditation is achieved through an International Laboratory

Accreditation Cooperation (ILAC) recognized body that offers accreditation [ISO/IEC

17205] to the USGv6 Test Program. A list of accredited test laboratories is maintained at the

USGv6 testing website. Inter-laboratory comparisons ensure that test methods for the same protocol functionality across all laboratories generate identical results. This avoids the problem of multiple accreditors having different schemes that may not harmonize. The results of interlaboratory comparison are posted to the USGv6 Program website.

USGv6 Test Program Element Lifecycles

The USGv6 Test Program exists in an environment in which technical requirements, product capabilities and test methods are constantly evolving. It is important that the test program and the interpretation of its results accommodate graceful forward evolution while maintaining appropriate control on the quality of its results.

The table below describes example major events in the evolution of the test program and the impact on vendors and agencies.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Table 1 USGv6 Test Program Lifecycles

Conditions and Events Impact on Vendor Impact on USG Agencies

Event: USGv6-v1.0 published July 2010.

Vendors issue SDoC with claims of supported tested capabilities, citing test results in accredited test labs.

Agencies should express their requirements for IPv6 capabilities in terms of the

USGv6 profile and should request vendors to supply

SDoCs traceable through the

USGv6 testing program to document compliance with such requirements.

Event: New USGv6

Profile revision published. (Revision 1 of the profile for example)

Begin migrating products to support any new or changed capabilities and plan for subsequent testing

IPv6 plans can include the new capabilities but specific procurement requirements for new capabilities should not be cited until 24 months after its publication.

Condition: No test selections exists for IPv6 requirements.

Claims of support can be made in SDoC, only subject to vendor self-testing outside the scope of this program.

Test results for these capabilities are not traceable through the accreditation structure of this program.

Agencies may specify their own verification requirements.

Condition: Test selections exist for specific IPv6 capabilities within the profile.

SDoC claims of support for a given IPv6 capability MUST be supported by results from accredited test laboratories.

Test results for these capabilities are traceable through the accreditation structure of this program.

Agencies may verify by contacting the accredited test laboratory.

Event: New test selections become effective or new major version number of test specification is published.

Products claiming the related

IPv6 capabilities in SDoC must test by 24 months after publication. They may test against the older version in the interim.

USG agencies may seek IPv6 products with SDoC that specifies compliance to the profile based on the new tests, 24 months after their publication date.

Event: New minor version number change of test specification.

No requirement for retest of products already claiming

SDoC for these functions.

USG agencies continue to seek IPv6 products with

SDoC that specifies the current major version of the tests (e.g., v.1.x, v.2.x).

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Claims of Product Compliance

USG agencies seeking to acquire products with IPv6 capabilities are advised to require submission of the Supplier’s Declaration of Conformity (SDoC) as documentation of the verified capabilities of offered products. The details of what is included in SDoC are given in

Sections 4.1 and 4.2. The question of what products can be claimed as equivalent to the tested version and included in the same SDoC is discussed in Section 4.3. Finally, the vendor’s test process culminating in the production of SDoC is discussed in Section 4.4. A template for the SDoC is given in Appendix 1.

4.1. Preliminary Requirements

Product vendors are advised to use the USGv6 Capabilities Table (UCT) [SP-500-267Br1s] or capabilities strings outlined in the USGv6 Profile as a means to document the capabilities implemented in products. The capabilities string(s) of the tested product will be displayed on the SDoC. Individual products may have multiple capability strings corresponding to the support of multiple distinct IPv6 stacks, or distinct software functions. It is product vendors who identify and select an accredited test laboratory, submit their products, and request test of selected capability sets. A list of accredited test laboratories and supporting accreditors is given at the USGv6 Program website.

4.2. Product Requirements

The profile defines a set of capabilities of IPv6 related functions that can be grouped together in very flexible ways. For example, capabilities can be grouped to identify requirements for hosts, routers, switches, network protection devices, etc.

Agency users developing technical requirements for IPv6 features in networked IT products can use the USGv6 Profile to precisely specify such requirements. The USGv6 Profile provides guidance on the selection of individual IPv6 capabilities for various product types and use case scenarios. Some capabilities are recommended by the profile as mandatory

(“M”) and should be included in all such specifications unless there is a strong reason to override this guidance. All other capabilities are considered optional and should be added to requirement statements as needed.

4.3. Documenting Product Capabilities

Modern networked IT products and services can be realized in a wide variety of configurations. All components (e.g., hardware, networking software, operating system) of an individual product maybe provided by a single vendor. More complex product configurations might involve components from multiple vendors (e.g., distinct hardware and operating system vendors). Even if we limit our focus to networking software, what is sold as an individual product might actually be a product bundle involving multiple vendors and/or individually tested components.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

The SDOC used in the USGv6 program provides the flexibility to describe and support all such product configurations. The sections that follow describe how to employ SDOCs to describe various product configuration scenarios.

4.3.1. Unitary Products

Typically found when a single supplier implements all of the IPv6 capabilities claimed for the product. The SDoC attestation required is:

"All of the declared capabilities of this product are addressed by original test results reported in this SDoC."

4.3.2. Composite Products

Composite products (i.e. products whose IPv6 capabilities are provided by the application or integration of one or more distinct components) can inherit the IPv6 test results of their individual component parts. To do so the precise component parts and their test specific test results must be documented. The USGv6 Test Program recognizes three cases of composite products:

1. Single IPv6 Component - A vendor bundles a composite product in which all the capabilities within the scope of the USGv6 Profile are provided by a single, independent product (e.g., stock OEM operating system on commodity hardware), that itself has completed testing. In this case, the vendor of the composite product does not need to repeat testing. The composite product vendor must still complete a Suppliers Declaration of

Conformity for the final product; in particular the product description and declaration. Note that this declaration requires that the product vendor make the composite product attestation as below. The vendor submits an SDoC front sheet referencing the attached original Stack

SDoC. This case is primarily intended to address the scenario of an OEM operating system bundled with commodity hardware. It should be noted that this scenario is equally applicable to a single vendor that employs the same distinct IPv6 components in a series of products.

2. Multiple IPv6 components - A vendor bundles a composite product whose IPv6 capabilities are provided by the integration of two or more distinct components that have been tested in an alternative IPv6 stack context. This declaration requires that the composite vendor attest to the following:

“Some or all of the capabilities of this product are provided by the use and/or integration of unmodified components that have their own unique SDoCs. 2”

2 Notes:

(1) The SDoC for a component need not comprise a full stack set of capabilities.

(2) In the OEM case, the single attached SDoC does comprise a full stack set of capabilities.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

4.3.3. IPv6-only Environments

Many forward-looking organizations are migrating away from dual stack deployments to

IPv6-only environments in which IPv4 services are no longer supported. Not all products are capable of being fully functional in such IPv6-only environments.

Recent revisions of the USGv6 profile provide the definition of an explicit IPv6-Only capability that requires the full lifecycle of a product to be fully functional in networks that lack IPv4 services. Products that wish to claim to be fully functional in IPv6-only environments must support the IPv6-Only capability and in addition attest that:

“This product has been tested for the IPv6-Only capability. This product is fully functional in IPv6-only environments. That is, no claimed capabilities are invalidated if this product is deployed in a network environment that does not support IPv4.”

4.3.4. Multiple Stacks per Product

Some products implement multiple IPv6 stacks, for example to accommodate separate management and data plane functions. The following supplementary attestation must be checked to identify these cases.

“This SDoC contains a capability test report for each unique IPv6 stack in the product. If not, the stacks/ports not covered are documented, and how their Ipv6 capabilities differ from those reported are explained.”

4.3.5. Product Families

A single vendor may identify “product families”, as a set of distinct product offerings (e.g., unique product name, version and configuration) that have identical and unmodified IPv6 capabilities. That is, the products only vary in ways that do not impact the capabilities within the scope of the USGv6 Profile.

In this scenario, the product family can inherit the test results of one of its members. The vendor must supply an SDoC that identifies the specific product configuration that was tested but can then list additional product configurations as both hardware and software versions that are declared within the same family, and thus share the same test results. Note that the declaration of a product family requires that the vendor attest to the following.

"All of the products listed in this product family are implemented such that their IPv6 capabilities are identical in form and function across the entire product family. The specific conformance and interoperability test results for the IPv6 capabilities of an identified member of this product family are provided in this SDoC. This SDoC attests to the fact that these tested IPv6 capabilities are identical in form and function for all the products cited above."

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

While a vendor may have a clear idea of what constitutes a coherent product family, based on hardware and operating system similarities, the test laboratory is also responsible for the validity of the test results. It may be prudent in the case of product family for the test laboratory to choose which instance from the product line is tested and may want to test a more than one member of the claimed product family.

4.4. Self-Test and Self Declarations

USGv6 standardized test suites are published on the USGv6 Program website [USGv6-Web].

The functional test specifications are hosted on laboratory web sites. In making claims of conformance, a vendor must pass the published tests for the IPv6 capabilities they claim support for. Where tests do not exist, vendors claim support in the SDoC based on “Self-

Test” statements. Note that the lack of a published IPv6 test for a given capability does not lessen or alter the underlying IPv6 technical requirements for a given capability. Product vendors should not knowingly claim support for an IPv6 capability when their product does not conform to the published requirements.

In the normal situation where a product vendor has passed tests and issued an SDoC, it will not be necessary to retest, until after a product upgrade affecting the IPv6 stack. However, where a capability is claimed based on Self-Test and a test specification for that capability is subsequently published, vendors are required to pass the tests within 24 months of their publication date. In the event that a minor version upgrade to the product is issued due to a bug fix relating to a claimed but untested capability, the product vendor should retest using the newly adopted test specification as documented in the test selection table.

New test specifications are added to the USGv6 Test Program incrementally. Many IPv6 capabilities do not have an associated public test specification. There is no guarantee that complete coverage will ever be reached. Each product supplier is expected to implement prudent in-house quality assurance testing strategies. The USGv6 Program testing will in most cases be less rigorous than internal testing associated with product development but exists as a sampling check on product quality assurance (QA). USGv6 capabilities that lack a standardized test suite are labeled in the SDoC as Self-Test. The supplier is expected to attest to the integrity of their own in-house QA by completing the results columns of the SDoC as

Self Declaration.

4.5. Traceability and Applicability of Test Results

The concepts of composite products and product families have been developed to ease the vendor’s burden for duplicative testing, while maintaining an acceptable level of product assurance and traceability of results within the USGv6 Test Program. We rely on the test lab

/ vendor relationship to establish and document the scenarios in which product families and composite products may inherit a prior test result. It is expected that all such vendor claims of inherited test results can, and will be, explicitly affirmed by the cited test labs should a user decided to verify the test results claimed in any given SDoC.

Each lab may establish the procedures by which composite products and product families are identified, as long as they meet the requirements and guidelines provided by the USGv6 Test h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Program. In the end, we rely on the natural tension between a lab’s desire to maintain its reputation and accreditation in the USGv6 Test Program and its desire to avoid duplicative testing for its customers, the product vendors. A given lab, for example, might require sample testing of two or more instances before being willing to attest to inherited results for an entire family or a composite product. All claims and reports of test results should always explicitly indicate what product configurations were actually tested and which additional configurations those results are deemed applicable to. The SDoC is designed to facilitate this identification and feedback through the usgv6-testing@list.nist.gov email list is encouraged.

Note also, that should a lab determine that at some point that there is reason to suspect that the validity of previously identified and agreed upon inherited test results, the lab is free to request further tests from the vendor and/or modify the set of products for which it is willing to affirm test results for. It is expected that it is in all parties’ best interests (i.e., vendors, test labs, accreditors, and users) to efficiently identify and resolve such issues.

4.6. IPv6 Product Supplier’s Process

This section describes the process that suppliers of IPv6 products will go through, from specification, through development, testing, to USG acquisition via SDoC production.

• Initial IPv6 product development.

• In-house testing:

o QA testing using open source or proprietary tools.

• Select an accredited USGv6 test laboratory:

o Specify IPv6 capabilities claimed to determine what testing is required.

o Undergo USGv6 testing with current test selection tables (TSTs).

• Develop and publish Supplier’s Declaration of Conformity (SDoC) o Subject to constraints listed in Section 4.4 above for:

Tested hardware and software combinations.

Composite products.

Product families.

Self-declared testing where no published test exists yet.

• Submit the SDoC to the USGv6 Tested Products Registry [USGv6-Tested].

• Submit SDoC in response to individual procurement requests / actions.

• Periodically (see Section 3):

o Retest product against test specifications with published major revisions.

o Retest product for capabilities with newly published test specifications, that were previously self-declared.

o Revise SDoC and re-publish.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Acknowledgments

The original design of the USGv6 Test Program was primarily the work of Dr. Stephen

Nightingale who retired from NIST before the development of this revision. While this revision reorganizes and streamlines some aspects of the original design, the program and this document is still largely the product of Stephen’s past work. The USGv6 Test Program is an active collaboration between NIST, the IPv6 Forum and the Interoperability Laboratory at the University of New Hampshire (UNH-IOL) – the IPv6 Ready Logo committee’s US representative organization. This and previous versions of this document have benefited by extensive public review and comment. We thank those who took the time and effort to contribute to improving the quality of this program.

h is p u b lic a tio n is a v a ila b le fre e o f c h a rg e fro m : h ttp s ://d o i.o rg /1

.6

/N

IS

T

.S P

.5 -2

Appendix A: Supplemental Materials

The template for the USGv6 Supplier’s Declaration of Conformity can be found in the supplemental file [SP500-281Ar1s].

Appendix B: Change Log

The material in this document represents an consolidation and revision of the sections of

[SP500-267] that pertained to declarations of conformance and testing and the original version of this document [SP500-281].