Subject: Re: [Ipsec] IKEV2 questions

From: Saroop Mathur <[email-masked]>
Date: Fri, 11 Mar 2005 08:12:50 -0800 (PST)

--- Fukumoto Atsushi <[email-masked]> wrote:

> Then I have to wonder why it is that way?  It looks like replacing No
> ESN to some other value and ID=0 to mean Optional seems to be more
> consistent with other transform types.

Agreed that 0 should not have been defined as a transform value for
ESN. But ID-O does not mean Optional for other transform types. ID-0 is
a reserved value for most transform types and cannot be send in a SA
proposal.

-Saroop

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 11 Mar 2005 20:17:21 +0200

> a reserved value for most transform types and cannot be send in a SA

Actually not so. ID=0 is reserved in Encryption Algorithm nad
Pseudo-random function. ID=0 is NONE for Integrity Algorithm
and Diffie-Hellman Group. And if only value you would be sending would
be NONE, then you are allowed to leave out the whole transform type
(3.3.3 last sentence).

As ID=0 is not NONE but "No extended sequence numbers" in the Extended
sequence numbers transform type, it cause confusion when combined with
3.3.3.3. My recommendation is that we modify the 3.3.2 by removing the

"If Transform Type 5 is not included in a proposal, use of
Extended Sequence Numbers is assumed."

and also modifying the Transform type values table to say

"Extended Sequence Numbers (ESN) 5  (AH and ESP)"

and also modifying the 3.3.3 so that we move ESN from Optional Types
to Mandatory Types for ESP and AH.
-- 
[email-masked]