Subject: [Ipsec] Another IKEv2 issue IKE SA with NONE INTEG and/or ENCR_NULL as ENCR.

From: Tero Kivinen <[email-masked]>
Date: Fri, 3 Sep 2004 13:28:39 +0300

I just noticed that we do not forbid of using encrption algorithm
ENCR_NULL and integrity algorithm NONE for the IKE SA. Or at least I
didn't find text about it.

I think we should explicitly say that integrity algorithm cannot be
NONE in IKE SA (it will completely break the authentication I think),
and perhaps same thing about encryption algorithm ENCR_NULL (it will
break the identity protection).

So add a paragraph to section 3.3.3 saying:

"For the IKE SA integrity algoritm MUST NOT be NONE, and encryption
algorithm MUST NOT be ENCR_NULL."
-- 
[email-masked]

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Dondeti, Lakshminath" <[email-masked]>
Date: Fri, 03 Sep 2004 08:57:52 -0400

>algorithm MUST NOT be ENCR_NULL."
This probably was a side-effect of separating algorithms out of the 
spec.  This text should go into the security considerations, I would think.

regards,
Lakshminath