Subject: Re: [IPsec] Obsolete Statements in RFC4306 (IKEv2)

From: <[email-masked]>
Date: Fri, 4 Apr 2008 14:29:00 +0300

Chinh Nguyen wrote:

> Given this clarification in rfc 4718:
> <<
>     Moreover, the combination of ESP and AH (between the same
>     endpoints) had already become largely obsolete in 1998 when RFC
>     2406 was published.  Our recommendation is that IKEv2
>     implementations should not support this combination, and
>     implementers should not assume the combination can be made to
>     work in an interoperable manner.
>  >>
> 
> Are the following statements obsolete in rfc 4306:
> 
> <<
>     IKE can also negotiate use of IP Compression (IPComp) [IPCOMP]
>     in connection with an ESP and/or AH SA.
>  >>
> 
> should be "ESP or AH SA"

I agree; thanks for catching this! (Searching for the string "and/or"
reveals couple of other places that should be fixed in IKEv2bis.)

> <<
>     When SAs are nested, as when data (and IP headers if in tunnel
>     mode) are encapsulated first with IPComp, then with ESP, and
>     finally with AH between the same pair of endpoints, all of the
>     SAs MUST be deleted together.
>  >>
> 
> should be "first with IPComp, then with ESP or AH"

This has been fixed in the current IKEv2bis draft already.

> <<
>     If two successive structures have the same Proposal number, it
>     means that the proposal consists of the first structure AND the
>     second.  So a proposal of AH AND ESP would have two proposal
>     structures, one for AH and one for ESP and both would have
>     Proposal #1.
>  >>
> 
> (In fact, support for proposals with same number not necessary at
> all.  The only other usage I can think of, IPCOMP, is now a NOTIFY
> payload).

This has also been fixed already.

Best regards,
Pasi
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec