Subject: [Ipsec] Will ikev2-16 be the charm?

From: "Charlie Kaufman" <[email-masked]>
Date: Mon, 13 Sep 2004 23:11:51 -0700

I have a revised I-D for IKEv2 ready to go unless someone tells me not
to submit it. The first two changes below motivated the revision. The
others respond to recent discussions on the list and some IESG comments
that I had misplaced.

1) Added the text: "All IKEv2 implementations MUST be able to send,
receive, and process IKE messages that are up to 1280 bytes long, and
they SHOULD be able to send, receive, and process messages that are up
to 3000 bytes long."

(Note: this differs from the text Ted sent me in two ways: it requires
that implementations be able to send as well as receive messages of the
minimum size and it states the limits in terms of the sizes of IKE
messages rather than "packets" since as pointed out on the list,
"packets" was incorrect and/or ambiguous.)

2) Removed the two ECC groups from Appendix B.

3) Changed references to RFC 2284 to RFC 3748, references to Extended
Authentication Protocol to Extensible Authentication Protocol, and made
some editorial corrections related to EAP proposed by Jari Arkko.

(Note: RFC 2284 was obsoleted by RFC 3748 in June. Jari Arkko had
proposed the related corrections earlier this year, but recently
resubmitted them including proposed wording).

4) Added a note to security considerations saying that IKE MUST NOT
negotiate NONE as its integrity protection algorithm or ENCR_NULL as its
encryption algorithm.

5) Added I-D boilerplate concerning IPR claim disclosure.

6) Clarified that "empty" messages included a single empty Encrypted
payload.

7) Added (SA) after first reference to "Security Association".

8) Noted that incompatible configurations of traffic selectors SHOULD be
noted in error logs.

9) 3 minor editorial clarifications.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Theodore Ts'o" <[email-masked]>
Date: Thu, 16 Sep 2004 01:00:27 -0400

> others respond to recent discussions on the list and some IESG comments

Thanks, Charlie for making these changes.  Please submit this at your
earliest convenience, and then we'll send it back to the IESG so they
can conclude their voting.

						- Ted

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 20 Sep 2004 16:36:24 +0300

> others respond to recent discussions on the list and some IESG comments
...
> 9) 3 minor editorial clarifications.

Did those include fixing the section 3.15.1 table so that
INTERNAL_IP?_SUBNETS are multivalued?

Hmm... my mail (<[email-masked]>)
included 4 changes, with first one changing text in 2 places. Which
one of those were included?
-- 
[email-masked]

---

From: "Yoav Nir" <[email-masked]>
Date: Mon, 20 Sep 2004 17:14:57 +0300

No.  According to the draft in vpnc.org (section 3.15.1)

- Attribute type is 7 bits (should be 15, or else there should be more
reserved bits)
- INTERNAL_IP*_SUBNET is not multivalued, but...
- To quote: "Multiple sub-networks MAY be requested."

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Tero Kivinen
Sent: Monday, September 20, 2004 4:36 PM
To: Charlie Kaufman
Cc: [email-masked]; [email-masked]; [email-masked]; Barbara Fraser
Subject: [Ipsec] Will ikev2-16 be the charm?

...