Subject: [Ipsec] Re: Results of straw poll regarding: IKEv2 interoperability issue

From: "Theodore Ts'o" <[email-masked]>
Date: Wed, 6 Apr 2005 10:56:59 -0400

Hi Russ,

My apologies for not getting back to you earlier.  A combination of
killer travel commitments, fairly nasty bouts of the flu (for both
Barbara and myself, at different times), and the desire to touch base
with all of the members of the ipsec wg management team slowed down my
response.

We agree that the relatively few number of people who responded to the
straw poll was certainly not ideal.  However, it is it is true the
number of people who have been actively participating in the ipsec has
been declining over time, and the people who responded were people who
have had a history of participating in the ipsec working group.  So we
feel that we should consider the approach of changing IKEv2 to make
transform type 5 (extended sequence number) working group consensus.

As far as the technical aspect of the decision, the fact that many
people at the interop meeting failed to achieve interoperability
simply by reading the document troubles us, and trying to fix this in
a clarification document that will be published separately, and later,
seems to be simply asking for interoperability problems. 

Changing transform type 5 to be mandatory does not require a
significant change to the document, nor to existing implementations
that have already implemented extended sequence numbers.  Furthermore,
requiring implementations to support ESN does not appear to be overly
burdensome.  

						- Ted

On Tue, Mar 15, 2005 at 10:13:27AM -0500, Russ Housley wrote:
> Ted:
> 
> The fact that so few people responded to the straw poll causes alarm.  The 
> issue was raised at a bake-off, and some of the implementations represented 
> at the bake-off are not represented in the straw poll responses.
> 
> I have a question: Do you believe that this response represents WG 
> consensus?  If so, then please prepare an RFC Editor note that describes 
> the change that needs to be made, send it to me, and I will work with the 
> IESG to get it approved.  If not, then we should not make any changes.
> 
> The WG chairs must judge consensus.  In this case, it is a subjective 
> decision, and you may want to consult with WG participants that did not 
> respond to the straw poll to figure it out.  At least one person that was 
> at the bake-off has told me that they had come up with a way to achieve 
> interoperability without making changes.  I think Paul Hoffman made a 
> posting to the mail list about that approach half way through the straw 
> poll.  This is just one more dimension of your consensus decision.
> 
> Russ
> 
> 
> At 07:50 PM 3/14/2005, Theodore Ts'o wrote:
> 
> >Two weeks ago, there was a discussion about an interoperability problem
> >in IKEv2 that was turned up during interoperability testing.  A week
> >ago, I called for a straw poll; based on the fact that the number of
> >responses was a little sparse, and last week was the Minneapolis IETF, I
> >let the straw poll go on all last week.
> >
> >The straw poll indicated a majority (although certainly not unanimity)
> >preference for proposal C:
> >
> >        PROPOSAL C:
> >        -----------
> >
> >        Change the places that says Transform Type 5 is optional to say
> >        it is mandatory.
> >
> >This choice unfortunately would require making changes to the IKEv2 RFC
> >before it is published, and since it has already been through the IESG
> >approval process and almost through the entire RFC editor process,
> >presumably we would need to make a new I-D and then take it through most
> >of this process all over again --- although hopefully it would take much
> >less time the second time around.
> >
> >Russ, would you comment if there is anything special we need to do at
> >this point?   Many thanks,
> >
> >                                                - Ted
> >
> >
> >Proposal A:
> >        Kevin Li <[email-masked]>
> >        Timothy Liu <[email-masked]>
> >
> >Proposal C:
> >        Srinivasa Rao Addepalli <[email-masked]>
> >        Geoffrey Huang <[email-masked]>
> >        Michael Roe <[email-masked]>
> >        Grubmair Peter <[email-masked]>
> >        Tero Kivinen <[email-masked]>
> >        Geoffrey Huang <[email-masked]>
> >
> >Proposal D:
> >        Paul Hoffman <[email-masked]>
> >        [email-masked]
> >        Yoav Nir <[email-masked]>
> 

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Russ Housley <[email-masked]>
Date: Wed, 06 Apr 2005 11:31:13 -0400

Ted:

I know about travel schedules, mine has been hectic too.  I hope you and 
Barbara are well.

As WG chair, the consensus call is yours to make.

If the change is small, I suggest that we do it with an RFC Editor 
note.  First, the content of the note needs to be approved by the WG and 
then by the IESG.  However, we do need to hurry.  ESP v3 is now in the RFC 
Editor queue, and 2401bis only has one open IESG issue.  Once 2401bis gets 
to the RFC Editor queue, the updated document series will be complete.

Russ

---

From: Tero Kivinen <[email-masked]>
Date: Thu, 7 Apr 2005 13:40:41 +0300

> note.  First, the content of the note needs to be approved by the WG and 

The change would be (I include the whole tables so the formatting will
be done correctly):
----------------------------------------------------------------------
In section 3.3.2 remove "optional in" from the ESN line, i.e. change

   Transform Type Values

                                     Transform    Used In
                                        Type
          RESERVED                        0
          Encryption Algorithm (ENCR)     1  (IKE and ESP)
          Pseudo-random Function (PRF)    2  (IKE)
          Integrity Algorithm (INTEG)     3  (IKE, AH, optional in ESP)
          Diffie-Hellman Group (D-H)      4  (IKE, optional in AH & ESP)
          Extended Sequence Numbers (ESN) 5  (Optional in AH and ESP)
          RESERVED TO IANA                6-240
          PRIVATE USE                     241-255

to

   Transform Type Values

                                     Transform    Used In
                                        Type
          RESERVED                        0
          Encryption Algorithm (ENCR)     1  (IKE and ESP)
          Pseudo-random Function (PRF)    2  (IKE)
          Integrity Algorithm (INTEG)     3  (IKE, AH, optional in ESP)
          Diffie-Hellman Group (D-H)      4  (IKE, optional in AH & ESP)
          Extended Sequence Numbers (ESN) 5  (AH and ESP)
          RESERVED TO IANA                6-240
          PRIVATE USE                     241-255
----------------------------------------------------------------------
In section 3.3.2 remove last paragraph from the description of the
Transform Type 5, i.e. change:

   For Transform Type 5 (Extended Sequence Numbers), defined Transform
   IDs are:

          Name                                Number
          No Extended Sequence Numbers       0
          Extended Sequence Numbers          1
          RESERVED                           2 - 65535

          If Transform Type 5 is not included in a proposal, use of
          Extended Sequence Numbers is assumed.

to

   For Transform Type 5 (Extended Sequence Numbers), defined Transform
   IDs are:

          Name                                Number
          No Extended Sequence Numbers       0
          Extended Sequence Numbers          1
          RESERVED                           2 - 65535

----------------------------------------------------------------------
In section 3.3.3 move ESN to mandatory types of the ESN an AH, i.e.
change:

          Protocol  Mandatory Types        Optional Types
            IKE     ENCR, PRF, INTEG, D-H
            ESP     ENCR                   INTEG, D-H, ESN
            AH      INTEG                  D-H, ESN

to

          Protocol  Mandatory Types        Optional Types
            IKE     ENCR, PRF, INTEG, D-H
            ESP     ENCR, ESN              INTEG, D-H
            AH      INTEG, ESN             D-H
-- 
[email-masked]

---

From: Russ Housley <[email-masked]>
Date: Thu, 07 Apr 2005 15:06:49 -0400

All:

This is sufficiently small.

Ted & Barbara:

Now, I need to confirm that this is the WG consensus.

Once you have done so, please send me a formal request, formatted like AUTH 
48 input to the RFC Editor.

Russ

---

From: "Theodore Ts'o" <[email-masked]>
Date: Wed, 13 Apr 2005 18:39:54 -0400

> 48 input to the RFC Editor.

ACK.  Based on the discussion on the wg mailing list, and straw poll
conducted a few weeks ago, we believe this is indeed the WG consensus.

I note that 2401bis has been approved by the IESG and sent to the RFC
editor, but it has not yet appeared in the RFC editor's queue.  When
it does appear, I will send a note to the RFC editor and cc you.
Please let me know if you'd like us to follow some different process.

						- Ted