Subject: [Ipsec] PFKEY and IKEv2?

From: Markku Savela <[email-masked]>
Date: Thu, 20 Jan 2005 12:21:59 +0200

[those who do not use PFKEY, *IGNORE* this message]

There used to be a PFKEY mailing list, but I have lost the
reference. Is it still alive?

Does everyone invent their own extensions to the PFKEY v2 to support
IKEv2?

I would prefer that there would be some PFKEYv3. At least it would be
nice to agree on the new extension formats for passing the traffic
selectors.

So, is this list the place to plan on these or will someone provide me
a reference to a working PFKEY mailing list?

-- 
Markku Savela

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Jari Arkko <[email-masked]>
Date: Thu, 20 Jan 2005 13:53:38 +0200

Hi Markku,

> a reference to a working PFKEY mailing list?

I don't think a working one exists although the list may
still exist somewhere.

Anyway, the history in this matter is that the original PF_KEY idea
was great but that the specifications didn't quite go all the way
towards providing everything that a real implementation would need.
So people ended up adding their own extensions. At some point
I, for instance, tried to propose a common extension, but didn't
receive a lot of interest from others. Probably there were a few
other attempts and proposals as well.

Going forward the critical question is whether everyone who
uses PF_KEY and has their own extensions is going to want to
upgrade to a PF_KEYv3, if someone were to make that happen?
If yes, then maybe its worth talking about it. If not...

--Jari

---

From: Dan McDonald <[email-masked]>
Date: Thu, 20 Jan 2005 09:52:07 -0500

On Thu, Jan 20, 2005 at 01:53:38PM +0200, Jari Arkko wrote:

<SNIP!>

> was great

Thank you (as does Craig and Bao, I'm sure).  :)

> but that the specifications didn't quite go all the way towards providing
> everything that a real implementation would need.

In Solaris, our IKEv1 support required two big changes:

	- Extended ACQUIRE.  This would allow AH+ESP to be specified in a
          single acquire message.  If I understand 2401bis and IKEv2
          correctly, that can no longer happen.  (Unless IP compression is
          still negotiated, in which case the extended ACQUIRE is still
          useful.)

	- Inverse ACQUIRE.  If I'm a responder, I'd like to know what to
          use.  This is really the exception to the rule that PF_KEY should
          not be a policy interface.  ACQUIRE and inverse-ACQUIRE is where
          Key Management meets IPsec configuration policy.

> So people ended up adding their own extensions. At some point I, for
> instance, tried to propose a common extension, but didn't receive a lot of
> interest from others. Probably there were a few other attempts and
> proposals as well.

Yeah.  I suspect most of us were busy working on our own code bases.

> If yes, then maybe its worth talking about it. If not...

This will be my last post on this thread on the IPsec mailing list.
[email-masked] is still open for business, AFAIK, and people should go
there.

Dan

---

From: Francis Dupont <[email-masked]>
Date: Thu, 20 Jan 2005 17:19:55 +0100

In your previous mail you wrote:

=> we are working on extensions to support Mobile IPv6 and one of them
is needed by IKEv2 too.

Regards

[email-masked]

---

From: "Steven M. Bellovin" <[email-masked]>
Date: Thu, 20 Jan 2005 13:22:36 -0500

>If yes, then maybe its worth talking about it. If not...

I think a new, standardized PF_KEY version would be an excellent idea.

		--Prof. Steven M. Bellovin, http://www.cs.columbia.edu/~smb

---

From: Michael Richardson <[email-masked]>
Date: Thu, 20 Jan 2005 15:46:56 -0500

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "Jari" == Jari Arkko <[email-masked]> writes:
    Jari> the way towards providing everything that a real
    Jari> implementation would need.  So people ended up adding their
    Jari> own extensions. At some point I, for instance, tried to
    Jari> propose a common extension, but didn't receive a lot of
    Jari> interest from others. Probably there were a few other attempts
    Jari> and proposals as well.

    Jari> Going forward the critical question is whether everyone who
    Jari> uses PF_KEY and has their own extensions is going to want to
    Jari> upgrade to a PF_KEYv3, if someone were to make that happen?
    Jari> If yes, then maybe its worth talking about it. If not...

  It is high time to get a group together to do this.
  The problem has always been getting some critical mass to do this.

  I would move to PF_KEYv3.

- -- 
] Michael Richardson          Xelerance Corporation, Ottawa, ON |  firewalls  [
] mcr @ xelerance.com           Now doing IPsec training, see   |net architect[
] http://www.sandelman.ca/mcr/    www.xelerance.com/training/   |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [

---

From: Markku Savela <[email-masked]>
Date: Mon, 24 Jan 2005 10:38:57 +0200

Ok, there seems to be interest on this. How to proceed? "pf_key at
inner.net" does not seem to be working for me.

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 24 Jan 2005 09:45:07 -0800

>inner.net" does not seem to be working for me.

VPNC now set up a new PFKEY mailing list. See 
<http://www.vpnc.org/pfkey> for subscription information.

--Paul Hoffman, Director
--VPN Consortium