Subject: Re: [IPsec] IPsec maintenance/extensions WG?

From: Ana Kukec <[email-masked]>
Date: Tue, 22 Apr 2008 18:30:43 +0200

Hi all,

I support the idea of having IPSec maintainance/extensions WG. As you were
talking about extensions, i wonder if the CGA extension for IKEv2 could be
one of possible work items?

CGA [rfc3972] enabled IKEv2 could be extended to provide security without
any pre-deployed and/or centralized trust infrastructure based on IKEv2
peer authentication via IPv6 Cryptographically Generated Addresses. In
that case, we would need IKEv2 extensions in order to support IKEv2
authentication based on CGA address-proof-of-ownership and PAD extensions
(primarily) to ensure a secure initial CGA authentication.

I am also wondering about the MOBIKE extensions, as something similar
could be done also for MOBIKE.

Kind regards,
Ana

[email-masked] wrote:
> Hi,
>
> During the Philadelphia meeting, several folks expressed interest
> in forming a working group for IPsec maintenance and extensions.
>
> Since IKEv2 is included in, for example, various US Government IPv6
> profiles, we'll probably see a number of new IKEv2 implementations
> during the next couple of years.  Having a working group would
> provide a forum for discussing implementation questions, and
> ensuring that results from, e.g., interoperability workshops are
> actually written down in the specifications (which didn't happen
> for IKEv1).
>
> While some maintenance work has already been done (RFC 4718,
> draft-hoffman-ikev2bis), and the ipsec mailing list still exists,
> finding those has been difficult for non-insiders. Also, the
> maintenance work has so far focused largely on the "remote access
> VPN" (client-to-gateway) use case, which exercises slightly
> different parts of the specs than host-to-host and
> gateway-to-gateway IPsec.
>
> At the same time, there has been interest in standardizing small
> improvements and extensions that were not included in the IKEv2
> base specifications (just search for drafts containing "-ikev2-" 
> or "-ipsec-"). Some of those extensions could benefit from wider
> participation that having a working group would bring.
>
> To actually form a WG, we would need to agree on the initial
> charter scope, and have enough people to work on all the items
> we decide to take on. 
>
> My current thinking is that the WG charter should describe a small
> number of specific work items and reasonable timelines for
> completing them, as opposed to including everything related to
> IPsec and planning to have the WG around forever.
>
> To get some discussion started, please send your opinions on 
> whether having a WG would be a good idea, your thoughts on what 
> the charter should look like, and what you'd consider to be the 
> most important work items.
>
> (If you've talked with me about this topic earlier, please
> still post your opinions on the list for others to see.)
>
> Best regards,
> Pasi
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 22 Apr 2008 17:40:18 -0400

>could be done also for MOBIKE.

Ana,

Can you describe how the proposed CGA approach is better than the 
ongoing work in BTNS. My understanding of the CGA proposal is that it 
would allow each peer to verify that the other was using a randomly 
asserted IPv6 address, as asserted in IPv6 packet headers.  This does 
not strike me as useful for access control, beyond what BTNS could do.

Steve