Subject: [IPsec] Roadmap doc

From: "Sheila Frankel" <[email-masked]>
Date: Thu, 23 Oct 2008 11:13:35 -0400

We expect to post a version of the roadmap doc before the Minneapolis  
IETF. Meanwhile, we wanted to request input from the list on the doc's  
contents.

Here is the proposed TOC for the roadmap doc:

1.  Introduction
2.  IPsec/IKE Background Information
    2.1.  Interrelationship of IPsec/IKE Documents
    2.2  Versions of IPsec
    2.2.1.     Differences between "old" IPsec and "new" IPsec
    2.3.  Versions of IKE
    2.3.1.     Differences between IKEv1 and IKEv2
3.  IPsec Documents
    3.1.  Base Documents
      3.1.1.  "Old" IPsec
      3.1.2.  "New" IPsec
    3.2.  Policy
    3.3.  MIBs
    3.4.  Additions to IPsec
    3.5.  General Considerations
4.  IKE Documents
    4.1.  Base Documents
      4.1.1.  IKEv1 (IKE)
      4.1.2.  IKEv2
    4.2.  Additions and Extensions
      4.2.1.  Peer Authentication Methods
      4.2.2.  Certificate Contents and Management
      4.2.3.  Dead Peer Detection
5.  Cryptographic Algorithms and Suites
    5.1.  Encryption Algorithms
    5.2.  Integrity-Protection (Authentication) Algorithms
      5.2.1.  General Considerations
    5.3.  Combined Algorithms
      5.2.1.  General Considerations
    5.4.  Pseudo-Random Functions (PRFs)
    5.5.  Cryptographic Suites
    5.6.  Diffie-Hellman Algorithms
6.  IPsec/IKE for Multicast
7.  Outgrowths of IPsec/IKE
    7.1.  IPComp (Compression)
    7.2.  IKEv2 Mobility and Multihoming (MobIKE)
    7.3.  Better-than-Nothing Security (Btns)
    7.4.  Kerberized Internet Negotiation of Keys (Kink)
    7.5.  IPsec Secure Remote Access (IPSRA)
    7.6.  IPsec Keying Information Resource Record (IPsecKEY)
8.  Other Protocols that use IPsec/IKE
    8.1.  Mobile IP (MIPv4 and MIPv6)
    8.2.  Open Shortest Path First (OSPF)
    8.3.  Host Identity Protocol (HIP)
    8.4.  Extensible Authentication Protocol (EAP) Method Update (EMU) 10
    8.5.  Stream Control Transmission Protocol (SCTP)
    8.6.  Fibre Channel
9.  Security Considerations
10.  IANA Considerations
11. References
    11.1. Normative References
    11.2. Informative References

Sections 1 and 2 will contain introductory material about IPsec and  
IKE: their functions, placement in the stack, inter-relationships, etc.

The rest of the doc will basically be a list of RFCs, with a brief  
description of each. For the cryptographic algorithms, each section  
will describe where each type of algorithm is used within IPsec and/or  
IKE. For each algorithm, the following information will be included:  
whether it applies to IPsec, IKE, or both; requirement level (MUST  
etc.); special considerations (e.g. cannot be used with manual  
keying); how widely/commonly it is deployed. Section 8 (other  
protocols that use IPsec/IKE) will very briefly mention the context in  
which each protocol and/or RFC uses IPsec/IKE.

Questions for the list:
1) Are there any other topics that should be discussed?
2) Are there other classes of RFCs that should be included?
3) The doc currently includes "old" IPsec and IKEv1. Should they be  
eliminated?

Sheila and Suresh

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: [email-masked] (Arnaud Ebalard)
Date: Thu, 23 Oct 2008 18:24:23 +0200

Hi,                                                [mext added in CC]

>    8.1.  Mobile IP (MIPv4 and MIPv6)

IMHO, MIPv6 is user of IPsec/IKE but not a common user: it uses
IPsec/IKE for its protection but it also has some very tight
interactions with IKE/IPsec/[PF_KEY] and for that reason, specific
requirements:

- configuration via IKEv2 (various RFC)
- bootstrapping and efficient handling of movement in IPsec/IKE context
  (see draft draft-ebalard-mext-pfkey-enhanced-migrate-00 which is a
  follow-up of draft-sugimoto-mip6-pfkey-migrate-04) 

The problem is that this last item sits in the middle of the field with
IPsec WG on one side and MIPv6 on the other; each side considering that
it should be handled by the other.

At the moment, MIPv6 specification documents (3775, 3776, 4877, 5026,
...) have expectations on the behavior in IPsec/IKE environments but
IPsec/IKE (and possibly PF_KEY) are missing the interfaces to support
those requirements. This is currently making progress outside any
working group. 

In the end, I am wondering where this item stand w.r.t the roadmap
document. I know that it is not in the initial set of work items of the
WG but this does not prevent clarifying the position of the WG on it in
the doc, does it?

> 1) Are there any other topics that should be discussed?

the one above, i.e. where should MIPv6 IPsec/IKE roadmap/work be
handled ;-)

Cheers,

a+

---

From: <[email-masked]>
Date: Fri, 24 Oct 2008 11:48:54 +0300

BTW, yesterday IESG approved a similar roadmap document about SIP:

http://tools.ietf.org/html/draft-ietf-sip-hitchhikers-guide

Also, TCPM WG did a roadmap about TCP specs a while ago:

http://tools.ietf.org/html/rfc4614

You might want to take a look at these, and copy some of their
ideas about organizing the document etc.

IMHO we should include the "version 2" IPsec specs (RFC 24xx) since
they're widely used (and perhaps even mention "version 1" IPSec,
RFC 18xx, in a "Historical Documents" appendix or something, even
if just saying "these are for historical interest only").

Best regards,
Pasi

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of ext Sheila Frankel
> Sent: 23 October, 2008 18:14
> To: [email-masked]
> Subject: [IPsec] Roadmap doc
>

---

From: Yaron Sheffer <[email-masked]>
Date: Fri, 24 Oct 2008 11:48:50 +0200

Hi Sheila, Arnaud,

First, I am happy with the outline as presented here, including the 24XX
documents. If anything, it may be too ambitious (i.e. lengthy).

Regarding the interactions of MIP6 with IKE/IPsec:

- The Roadmap document should cover these areas, just as it covers other
consumers of this technology. But despite its (unfortunate) name, I don't
see the document as a future-looking position statement of the WG, but
rather as documentation of completed work.

- As for the actual work on MIP6/IPsec dependencies: the ipsecme WG is busy
today with documents that have far wider applicability to the IPsec
community. _If_ there is strong interest in these issues from a specific
community of people, perhaps the way to go about it is with a dedicated
design team.

Thanks,
	Yaron

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Arnaud Ebalard
Sent: Thursday, October 23, 2008 18:24
To: Sheila Frankel
Cc: [email-masked]; IETF MEXT WG ML
Subject: Re: [IPsec] Roadmap doc

Hi,                                                [mext added in CC]

Cheers,

a+

Scanned by Check Point Total Security Gateway.
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Hui Deng" <[email-masked]>
Date: Fri, 24 Oct 2008 23:04:33 +0800

Hello, all

We also have wrote this draft
http://tools.ietf.org/id/draft-qi-mip6-ikev2-interfacing-02.txt
and present in mip6 working group before several time.
and won the support from the floor, but no in the top priority list of
the current mext WG.

Regards,

-Hui

2008/10/24 Yaron Sheffer <[email-masked]>