Subject: Re: [Ipsec] Two IKEv2 issues from the IESG

From: Ravi Kumar <[email-masked]>
Date: Mon, 13 Sep 2004 10:03:52 +0530

My preference is :
Implementation MUST support sending/receiving  3000 bytes 
messages, in case of certificates.
Implementation SHOULD support HASH & URL for certificate 
retrieval.

-Ravi

----- Original Message -----
From: "Theodore Ts'o" <[email-masked]>
To: "Russ Housley" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>; 
<[email-masked]>
Sent: Friday, September 10, 2004 8:37 AM
Subject: Re: [Ipsec] Two IKEv2 issues from the IESG

 > On Thu, Sep 02, 2004 at 09:53:55AM -0400, Russ Housley wrote:
 >> Here are two issues from the IESG regarding IKEv2.  I 
hope that these can
 >> be quickly resolved by the IPsec Working Group.  Charlie 
has already agreed
 >> to quickly update the document to reflect the Working 
Group decision, once
 >> consensus is clear.
 >
 >> ELLIPTIC CURVES
 >>
 >> I am raising the second issue.  In 2002, the working 
group decided not to
 >> pursue elliptic curves.  Hilarie made several 
presentation advocating them;
 >> her slides are in the minutes.  However, the IPR 
concerns associate with
 >> elliptic curves lead the working group to classic 
Diffie-Hellman.  Yet, two
 >> elliptic curve groups are still included in the 
document.  This seems to
 >> contradict the working group decision.
 >
 > No one has objected to this change.  So Charlie, please 
remove
 > elliptic curve groups from Appendix B.
 >
 >> MINIMUM PACKET SIZE
 >
 > Please add the following text:
 >
 >>    "All IKEv2 implementations MUST be able to receive 
and process
 >>    packets that are up to 1280 bytes long, and they 
SHOULD be able
 >>    to receive and process packets that are up to 3000 
bytes long."
 >
 > There have been a few people who have suggested that they 
would prefer
 > a simple 3000 byte MUST requirement instead.  However, 
these people
 > seem to have been in the minority, and given that 1280 
bytes is enough
 > for a 1024 bit certificate, and 2048 with modest certificate
 > extensions, it seems that 1280 byte requirement is 
sufficient for many
 > applications.  In addition, it is likely that most 
implementations
 > will implemement SHOULD requirements.
 >
 > Do any of those people advocating the 3000 byte MUST 
object strenously
 > to the above text requiring a 1280 MUST, and a 3000 byte 
SHOULD?
 >
 > - Ted
 >
 > _______________________________________________
 > Ipsec mailing list
 > [email-masked]
 > https://www1.ietf.org/mailman/listinfo/ipsec

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Yoav Nir" <[email-masked]>
Date: Mon, 13 Sep 2004 09:34:51 +0300

Agree.

(I usually avoid "me too" responses, but since Ted is looking for people who
object to reducing the "MUST" requirement to 1280, I'm making an exception) 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Ravi Kumar
Sent: Monday, September 13, 2004 7:34 AM
To: [email-masked]
Subject: Re: [Ipsec] Two IKEv2 issues from the IESG

My preference is :

-Ravi

----- Original Message -----
From: "Theodore Ts'o" <[email-masked]>
To: "Russ Housley" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>; 
<[email-masked]>

hope that these can
has already agreed
Group decision, once
group decided not to
concerns associate with
Diffie-Hellman.  Yet, two
document.  This seems to
remove
and process
SHOULD be able
bytes long."
would prefer
these people
bytes is enough
sufficient for many
implementations
object strenously
SHOULD?