Subject: [Ipsec] question on draft "OCSP extension to IKEv2"

From: " 杜春燕(DU Chun-yan)" <[email-masked]>
Date: Wed, 29 Mar 2006 22:19:42 +0800

Hi,all!

	According to section 1 of OCSP Extensions to IKEv2(draft-myers-ikev2-ocsp-01.txt)：
    “CRLs can however grow unbounded in size. Many real-world examples exist to demonstrate the impracticality of including a multi-megabyte file in an IKE exchange. This constraint is particularly acute in bandwidth limited environments (e.g. mobile communications). The net effect is exclusion of in-band CRLs in favor of out-of-band (OOB) acquisition of these data, should they even be used at all.
	Reliance on OOB methods can be further complicated if access to revocation data requires use of IPsec (and therefore IKE) to establish secure and authorized access to the CRLs of an IKE participant. Such network access deadlock further contributes to a reduced reliance on certificate revocation status in favor of blind trust.”
	
	Then here is my question,
	(1)what is the meaning of "in-band" and "out-of-band" in IKE exchange? Give some examples? 
	(2)Does OOB needs to use IPsec/IKE to access to CRLs? Then how does it cause network access deadlock?

Thanks very much for ahead! 

Regard,
				 
　　　　　　　　 DU Chun-yan
　　　　　　　　[email-masked]
　　　　　　　　　　2006-03-29

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 29 Mar 2006 09:51:47 -0600

On Wed, Mar 29, 2006 at 10:19:42PM +0800,  ??????(DU Chun-yan) wrote:
> Hi,all!
> 
> 	According to section 1 of OCSP Extensions to IKEv2(draft-myers-ikev2-ocsp-01.txt)??
>     ??CRLs can however grow unbounded in size. Many real-world examples exist to demonstrate the impracticality of including a multi-megabyte file in an IKE exchange. This constraint is particularly acute in bandwidth limited environments (e.g. mobile communications). The net effect is exclusion of in-band CRLs in favor of out-of-band (OOB) acquisition of these data, should they even be used at all.
> 	Reliance on OOB methods can be further complicated if access to revocation data requires use of IPsec (and therefore IKE) to establish secure and authorized access to the CRLs of an IKE participant. Such network access deadlock further contributes to a reduced reliance on certificate revocation status in favor of blind trust.??
> 	

"in-band" -> sent on the wire in the same protocol's messages.

"out-of-band" -> each peer gets the CRL for the other's cert via some
                 means other than from the other peer in IKE messages,
		 usually by talking HTTP to a CRL DP.

> 	(2)Does OOB needs to use IPsec/IKE to access to CRLs?

A host might have to use IPsec to talk to a CRL DP; I suspect this is
not usually the case.

> 	                                                      Then how
> 	does it cause network access deadlock?

I'm not sure that having to talk IPsec to a CRL DP causes deadlocks, but
proxies and firewalls and what not might.

Nico
--