Subject: [IPsec] Ticket #73: Ticket location: prefer server-side ticket

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Sat, 24 Jan 2009 17:32:20 +0200

Hi all, 
Hi Hui, 

I would like to close issue #73: 
http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/73

Here is a copy-and-paste from the page: 
"
The document should recommend "by reference", in preference to "by
value" tickets; or make "by reference" a MUST, and "by value" a
SHOULD/MAY. Mainly for the following two reasons: 

- Less bandwidth, by not sending the ticket. - IKEv2 messages,
especially the first one, had better not be fragmented. 

See http://www.ietf.org/mail-archive/web/ipsec/current/msg03355.html and
numerous follow-ups. 
"

We need to differentiate IKEv2 initiator and IKEv2 responder with regard
to the RFC 2119 requirements: 

* For the IKEv2 initiator there are no implementation requirements with
regard to the ticket format. That's easy. 

* For the IKEv2 responder we cannot require any specific format either
as we are currently only recommending a possible format in the appendix.

As such, the usage of a ticket by value or by reference is a purely
deployment specific consideration. For example, imagine that you deploy
VPN gateways and want to use ticket by references only then you could do
that via configuration settings and the clients served by your VPN
gateway would only receives ticket per references and no ticket by
values. For the client there is no impact and at the server side it is
just a configuration setting (one among many). 

Ciao
Hannes

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 25 Jan 2009 12:50:51 -0800

>just a configuration setting (one among many).

Wearing my co-chair hat and looking at the charter, I agree with Hannes. This issue can be closed.

--Paul Hoffman, Director
--VPN Consortium