Subject: [Ipsec] RFC4305 Errata draft

From: "Vishwas Manral" <[email-masked]>
Date: Wed, 12 Apr 2006 09:55:34 -0700

Hi folks,

I have written a draft
http://www.ietf.org/internet-drafts/draft-manral-ipsec-rfc4305-errata-00.txtwhich
lists the errata in the RFC4305.

I think the draft is necessary(instead of just an errata) because the
changes relate mostly chaging a few MUST's to MAY(which is a much bigger
change).

I think we need to close this draft soon, as I can see the error being
propagated to other RFC's e.g. http://www.rfc-editor.org/rfc/rfc4294.txt .
And although I informed the author of the RFC it was already too late. If we
want we can rewrite the RFC with the changes incorporated(and additional
algorithms CMAC etc).

Any comments would be appriciated.

Thanks,
Vishwas
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Thu, 13 Apr 2006 22:24:03 +0300

This may be a stupid question, but why an errata draft that updates  
4305 instead of a new draft that obsoletes 4305?

On Apr 12, 2006, at 7:55 PM, Vishwas Manral wrote:

> Hi folks,
>
> I have written a draft http://www.ietf.org/internet-drafts/draft- 
> manral-ipsec-rfc4305-errata-00.txt which lists the errata in the  
> RFC4305.
>
> I think the draft is necessary(instead of just an errata) because  
> the changes relate mostly chaging a few MUST's to MAY(which is a  
> much bigger change).
>
> I think we need to close this draft soon, as I can see the error  
> being propagated to other RFC's e.g. http://www.rfc-editor.org/rfc/ 
> rfc4294.txt . And although I informed the author of the RFC it was  
> already too late. If we want we can rewrite the RFC with the  
> changes incorporated(and additional algorithms CMAC etc).
>

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 13 Apr 2006 14:26:28 -0500

> 4305 instead of a new draft that obsoletes 4305?

Errata updates nothing, they're not normative.  But errata fill a void
in between issuance of updates.

Also, a new RFC that corrects errors in one or more older RFCs need not
obsolete them.

Nico
--

---

From: Paul Koning <[email-masked]>
Date: Thu, 13 Apr 2006 15:33:33 -0400

If you're going to change the required status of ESP NULL
authentication -- which I support -- it would make sense to change it
all the way to SHOULD NOT.

The footnote about SHA-1 collisions also should be added to section
3.1.1. 

       paul

---

From: "Vishwas Manral" <[email-masked]>
Date: Thu, 13 Apr 2006 13:26:45 -0700

Hi Paul,

That is an interesting point. The current draft makes the ESP NULL
authentication to MAY, because RFC4303 and I guess RFC4301 state that
     - confidentiality-only (MAY be supported)

Do you think it is advisable to make that to SHOULD NOT?

Thanks,
Vishwas

---

From: "Vishwas Manral" <[email-masked]>
Date: Thu, 13 Apr 2006 13:29:52 -0700

Hi Yaov,

You have a good point there.

I am ok working on a draft that update's and obsoletes RFC4305 too, if we
envision more changes like adding the status of new algorithm's like CMAC in
the RFC I think that would be the advisable thing to do this. I have
mentioned this in the previous mail of mine.

Thanks,
Vishwas

On 4/13/06, Yoav Nir <[email-masked]> wrote:
>
> This may be a stupid question, but why an errata draft that updates 4305
> instead of a new draft that obsoletes 4305?
> http://www.ietf.org/internet-drafts/draft-manral-ipsec-rfc4305-errata-00.txtwhich lists the errata in the RFC4305.
>
> And although I in RFC it was already too late. If we want we can rewrite the
> RFC with the changes incorporated(and additional algorithms CMAC etc).
>
>

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 13 Apr 2006 13:54:31 -0700

>all the way to SHOULD NOT.

Then it is not an errata, it is a new protocol.

Vishwas: your choice. Do you want to turn these in as errata, or as a 
full replacement to 4305? If the latter, you should copy RFC 4305 
into a new document, make your changes, and add an appendix about 
what you have changed.

--Paul Hoffman, Director
--VPN Consortium

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 13 Apr 2006 16:10:14 -0500

> into a new document, make your changes, and add an appendix about 

You don't have to obsolete 4305 to make this change, but you can't
change RFC2119 language in errata without some evidence that the
language you're changing was incorrect in the original, and, anyways,
errata are not normative, they are not endorsed by any entity.

Nico
--

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 13 Apr 2006 15:05:21 -0700

At 4:57 PM -0400 4/13/06, Paul Koning wrote:
>Is that only when changing from MUST to SHOULD NOT -- and not when
>changing from MUST to MAY?  Why?

The MUST->MAY is clearly indicated by the current text itself. Going 
to SHOULD NOT is not (regardless of how much we agree on it).

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Koning <[email-masked]>
Date: Thu, 13 Apr 2006 16:55:01 -0400

>>>>> "Vishwas" == Vishwas Manral <[email-masked]> writes:

 Vishwas> Hi Paul, That is an interesting point. The current draft
 Vishwas> makes the ESP NULL authentication to MAY, because RFC4303
 Vishwas> and I guess RFC4301 state that - confidentiality-only (MAY
 Vishwas> be supported)

 Vishwas> Do you think it is advisable to make that to SHOULD NOT?

Yes, because of the problems Steve Bellovin documented a number of
years ago.

      paul

---

From: "Vishwas Manral" <[email-masked]>
Date: Thu, 13 Apr 2006 17:54:16 -0700

Hi,

I agree with Paul H. I will put togather another draft and send it across
with the diffs with RFC4305.

Thanks,
Vishwas

---

From: Stephen Kent <[email-masked]>
Date: Mon, 17 Apr 2006 13:32:27 -0400

At 9:55 AM -0700 4/12/06, Vishwas Manral wrote:
>Hi folks,
>
>I have written a draft 
><http://www.ietf.org/internet-drafts/draft-manral-ipsec-rfc4305-errata-00.txt>http://www.ietf.org/internet-drafts/draft-manral-ipsec-rfc4305-errata-00.txt 
>which lists the errata in the RFC4305.
>

as Paul noted, changing a MUST t a MAY makes this a candidate as a 
replacement RFC, not an errata.

Steve

---

From: "Vishwas Manral" <[email-masked]>
Date: Mon, 17 Apr 2006 12:57:28 -0700

Hi Steve,

I have put in a draft for the replacement rather then an errata. It should
be visible sometime soon in the IETF pages.

Thanks,
Vishwas

On 4/17/06, Stephen Kent <[email-masked]> wrote:
> http://www.ietf.org/internet-drafts/draft-manral-ipsec-rfc4305-errat
> a-00.txt which lists the errata in the RFC4305.
>