Subject: [Ipsec] First draft of IKEv2.1

From: Paul Hoffman <[email-masked]>
Date: Thu, 29 Dec 2005 13:41:59 -0800

Greetings again. Some VPNC members have complained about having to 
jump back and forth between the IKEv2 Clarifications document with 
the IKEv2 RFC. At the same time, they also have said that they don't 
like the SHOULDs in IKEv2 that have nothing to do with 
interoperability.

To that end, I have created a new document, for IKEv2.1. The first 
draft is at 
<http://www.ietf.org/internet-drafts/draft-hoffman-ikev2-1-00.txt>. 
Its main purpose is to fix the above two problems, but it can also be 
a springboard for needed core features that are not clarifications. 
The version number is 2.1 because some of the normative requirements 
(SHOULD and MUST) have changed. So far, there are no bits-on-the-wire 
changes, although it is believable that some will be introduced (such 
as new notifications) before the document is done.

Of course, I am open to comments and suggestions on improving the 
document. Given that we are starting to see IKEv2 implementations in 
the market, it would be good to close this document within a few 
months so that new implementers can go straight to version 2.1.

--Paul Hoffman, Director
--VPN Consortium

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Charlie Kaufman <[email-masked]>
Date: Thu, 29 Dec 2005 15:18:42 -0800

I haven't read this carefully yet, but I have a couple of related concerns:

If this document is limited to clarifications and truly minor revisions, then it should not change the version number from 2.0 to 2.1. The semantics of such a change are defined in the v2.0 document. Changing to 2.1 implies that the recipient should do something differently when seeing the 2.1 than when seeing the 2.0. If there is such a change, it should be carefully documented (e.g. if there were some new notification types that should only be sent to someone who agreed to speak version 2.1).

A related concern is that if there are going to be changes that are likely to affect interoperability, I would not expect we could sneak this through without re-forming a working group to review it. Some of your SHOULD vs. MUST changes were hard fought at the time (and I believe in some cases I wanted to make some of the changes you propose and was told not to by the working group).

It would be good to have a new base document for the next round of substantive changes to IKE and for that document to include the explanation of minor version number negotiation, but I wouldn't expect such a document to move forward any time soon. It would also be good to have a document that merges the original IKEv2 document with your clarifications - possibly as annotations, or possibly as integrated text. But we are still early in deployment, and I would expect that document would be updated frequently over the next few years.

	--Charlie

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul Hoffman
Sent: Thursday, December 29, 2005 1:42 PM
To: IPsec WG
Subject: [Ipsec] First draft of IKEv2.1

Greetings again. Some VPNC members have complained about having to jump back and forth between the IKEv2 Clarifications document with the IKEv2 RFC. At the same time, they also have said that they don't like the SHOULDs in IKEv2 that have nothing to do with interoperability.

To that end, I have created a new document, for IKEv2.1. The first draft is at <http://www.ietf.org/internet-drafts/draft-hoffman-ikev2-1-00.txt>. 
Its main purpose is to fix the above two problems, but it can also be a springboard for needed core features that are not clarifications. 
The version number is 2.1 because some of the normative requirements (SHOULD and MUST) have changed. So far, there are no bits-on-the-wire changes, although it is believable that some will be introduced (such as new notifications) before the document is done.

Of course, I am open to comments and suggestions on improving the document. Given that we are starting to see IKEv2 implementations in the market, it would be good to close this document within a few months so that new implementers can go straight to version 2.1.

--Paul Hoffman, Director
--VPN Consortium

g/mailman/listinfo/ipsec

---

From: Jari Arkko <[email-masked]>
Date: Fri, 30 Dec 2005 10:21:19 +0200

Paul Hoffman wrote:

> jump back and forth between the IKEv2 Clarifications document with the 
> IKEv2 RFC. At the same time, they also have said that they don't like 
> the SHOULDs in IKEv2 that have nothing to do with interoperability.
>

Great! That was fast.

> months so that new implementers can go straight to version 2.1.

I agree.

> a springboard for needed core features that are not clarifications.

I am very much in favor of speedy publication of an RFC that
combines clarifications and the base spec. And I agree that the
time for that is now. But I am a bit more sceptical about new
features. Also, I'm not quite sure what you meant with "don't like the
SHOULDs in IKEv2" part, and wonder if this is perhaps more of a "change"
than a clarification. But I guess I have to read the document to find
out exactly what was changed. I do realize that to fix some underspecified
things you have to add new SHOULD/MUST language, and this is fine -
I still consider it a clarification. But did you want to go beyond this?

Anyway, I think it might be an idea to just do the clarifications and
let new features be in other extension RFCs; new features tend to
take longer to develop, and from what I can see you already have
quite a bit of material just because of the clarifications.

--Jari