Subject: Re: [IPsec] IPsec maintenance/extensions WG?

From: Yaron Sheffer <[email-masked]>
Date: Tue, 22 Apr 2008 12:48:03 +0300

Hi,

I strongly support this idea. While the initial charter needs to be well 
defined, with clear goals and schedules, the new WG should also serve as 
a forum for discussing implementation issues. This would imply a 
lifetime beyond the first few RFCs.

During the Philadelphia meeting I played a bit with this notion, and 
here is the draft charter I came up with.

Thanks,

    Yaron

Name: IPsec Maintenance

The IPsec Maintenance working group is responsible for the maintenance, 
upkeep, and advancement of the IKE and IPsec protocol specifications and 
architecture. The working group will address protocol limitations/issues 
discovered during deployment and operation. It will also serve as a 
venue for discussing the proper location for working on 
IKE/IPsec-related issues within the IETF. The group is not chartered to 
develop major changes or additions to the IPsec suite of specifications.

Objectives:

- Standardize minor extensions to IKEv2. Changes with architectural 
ramifications (e.g. changes to the policy description model) are out of 
scope unless specifically chartered later. A non-exclusive list of 
relevant extensions is below.
- Provide technical guidance to other IETF workgroups, and to other 
SDOs, on the proper use of IKE/IPsec protocols. Assist such groups in 
developing specific profiles of IKE/IPsec protocols. Examples include, 
but are not limited to, the various routing protocol security efforts 
underway.
- Complete and publish the IKEv2bis (IKEv2 clarifications) work.
- Track IKE/IPsec interop events, clarify and revise the protocols if 
necessary following these events.

Relevant IPsec Extensions (extensions will become work items only by 
working group consensus):

[Note: this is *not* in priority order. The list should be narrowed down 
and target dates added.]

- IKEv2 IPv6 configuration

- IKEv2 session resumption (IFARE)

- IPsec secure beacon
- IKE crash detection
- IPsec with AEAD
- ESP-null marking

- IKE/GRE interaction

- IKEv2 OTP
- IKEv2 Captcha
- Various crypto algorithm-related drafts
- Anything that may be needed from IKE/IPsec with respect to routing 
protocol security.

All new work items not listed above require the approval of the working 
group and the sponsoring Area Director before they can be taken on by 
the working group.

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Ed Jankiewicz <[email-masked]>
Date: Tue, 22 Apr 2008 11:47:40 -0400

As someone involved with one of the above-mentioned IPv6 Profiles 
efforts, I would support establishing an IPsec maintenance WG and hope 
to contribute.   We are interacting with several vendors on IPsec 
topics, IKEv2 in particular, and are encouraging implementations, 
testing and interoperability events.  The draft charter is a good 
starting point. 

One additional topic of concern is IKEv2/IKEv1 co-existence.  With 
development cycles, it may be some time before IKEv2 becomes pervasive, 
and existing IKEv1 implementations will persist.  While IKEv2 by design 
is not interoperable with IKEv1, and I'm not proposing a major change to 
the protocol to make it so, I would like to see some realistic 
discussion of approaches to simplify implementation, deployment and 
management of IKE during the transition period.  Perhaps a work item for 
a Problem Statement on this would be reasonable?  No need to commit to a 
solution until that item is addressed.

Forgive me if this is a long-buried dead horse.  I was not involved in 
IETF activities at the time IKEv2 was developed and published, and there 
may be a long history of debate on the subject.  If so, no need to 
clutter the list with a recap, just drop me a line off-list.

-- 
Ed Jankiewicz - SRI International
Fort Monmouth Branch Office - IPv6 Research 
Supporting DISA Standards Engineering Branch
732-389-1003 or  [email-masked]