Subject: [MSEC] GSAKMP issue 00: IANA considerations

From: George Gross <[email-masked]>
Date: Sat, 9 Aug 2003 08:23:53 -0400 (EDT)

Hi,
	This e-mail and three others inexplicably did not make it to the
list (see the archive). My apologies if you receive a dupe.

br,
	George

GSAKMP issue 00

Section and relevant text passage:

The document as a whole is missing a comprehensive IANA considerations section. Also
the relationship of GSAKMP identifiers to similar ones found in IKE is unspecified.

Comment/issue description:

This is similar to the stuff found in IKE-v2 section 6, where there are numerous payload identifiers and
crypto algorithms/suites referenced that need IANA to maintain the registry.  WHile the spec
points to IKE as its template, it is not clear whether you expect to coordinate the GSAKMP payload
identifier space (or any of the other identifier spaces, see below) with IKE. Where feasible, it
would make sense to either converge to a common set with the IKE-v2 set of identifiers or else
use an non-colliding set of GSAKMP reserved identifiers within the IKE-v2 space.

Suggested issue resolution:

1. Every one of the various tables in the GSAKMP protocol specification that define identifiers should be
discussed in the IANA considerations section:
	- table 6 group identification types
	- table 7 payload types, coordinate with IKE-v2 section 3.2
	- table 8 exchange types, coordinate with IKE-v2
	- table 9 policy token types
	- table 10 key download data types
	- table 11 rekey event types
	- table 12 identification payload types, coordinate with IKE-v2 section 3.5
	- table 13 certificate payload types, coordinate with IKE-v2 section 3.6
	- table 14 signature types
	- table 15 signature ID types
	- table 16 authorization types
	- table 17 Notify payload types, coordinate with IKE-v2 section 3.10.1
	- table 18 Notify status types, coordinate with IKE-v2 section 3.10.1
	- table 19 acknowledgement types
	- table 20 key creation type
	- table 21 nonce type

2. The section 1.2 "Protocol Considerations" belongs as sub-section in the IANA section. This section
should specify that GSAKMP is in a UDP payload.

3. The generic header payload encoding should be aligned with IKE-v2 section 3.2, and it should
include the "critical" bit semantics. The GSAKMP mandated payloads should have this bit clear, as
explained by the rationale in IKE-v2.

4. All of the above identifier/type tables in GSAKMP should have a portion of their identifier space
reserved for private/experimental use between consenting parties

_______________________________________________
msec mailing list
[email-masked]
http://www.pairlist.net/mailman/listinfo/msec