Subject: Re: [IPsec] Resuming the session resumption discussion

From: "ma yc" <[email-masked]>
Date: Mon, 13 Oct 2008 18:22:16 +0800

Hi, all

After reading both drafts, I have the feeling that both solutions
need to find some places to store the ticket/stub before the
session resumption happens.

The Stub bank needs extra piece of storage which is located in
operator's network. In the ticket approach, this storage distributed
to the clients. Simply changing the storage location does not save
the storage as a total at all.

IMHO, I do believe the unit cost of Gateway storage is much cheaper
than the one internally inside the Client, especially when we consider
the mobile device case. Also, power consumption may increase to
maintain this kind of extra storage in mobile device.  For the sake of
maintainence cost, this extra piece of storage on the network side is
a better choice.

-Yuanchen

> <co-chair hat on>
>
> We now have revised drafts from the two parties who has published earlier drafts on session resumption. The (truncated) announcements are below.
>
> The WG should start discussing what we want from session resumption and which of these two drafts (or what ideas from each of these two drafts) is of interest to the WG. As a reminder, I start off with what our charter says.
>
> Extra points are awarded for not copying this entire message in your response. :-)
>
> --Paul Hoffman
>
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Mon, 13 Oct 2008 21:56:34 +0200

Hi Yuanchen.

I don't think this reasoning is quite correct. Storing thousands of  
stubs in a module accessible to multiple gateways (or persistent for  
one gateway) requires extra hardware and extra internal protocols. It  
has a real cost in terms of hardware.

Extra storage on the client is essentially free. Whether the client is  
a PC or a mobile phone, increasing the size of the IKE SA by the  
amount needed by the ticket should not be a problem. In one  
implementation I've seen, an IKE SA took about 1K-2K, while a ticket  
should be at about 0.5K. And the client side has only one IKE SA. What  
IKE implementation is so constrained that adding a 0.5K requirement  
has a measurable cost?

Yoav