Subject: [IPsec] Ticket #74: Extend IKE_SA_INIT instead of new exchange type

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Sat, 24 Jan 2009 17:30:25 +0200

Hi all, 
Hi Peng, 

I would like to close issue #74: 
http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/74

Here is a copy-and-paste from the page: 
"
Use IKE_SA_INIT with a ticket payload, instead of defining a new
exchange type.

Main reasons: - Simpler implementation, adding a new exchange requires a
lot of new code. - More efficient protocol of the responder *does not*
implement this extension. - Similar to RFC 5077 (TLS stateless
resumption).

See http://www.ietf.org/mail-archive/web/ipsec/current/msg03356.html and
follow ups.
"

We had a couple of mail exchanges on the list with regard to this issue
and so far we had a few folks being in favor of using the IKE_SA_INIT
exchange and some others to use the IKE_SESSION_RESUME exchange.

Here is the current status of the discussion (at least what I got from
the mailing list and from the IETF#73 IPSECME WG recording): 

IKE_SA_INIT exchange: 

* Hui Deng
* Peng Yang

IKE_SESSION_RESUME exchange: 

* Yaron Sheffer
* Tero Kivinen
* Stephen Kent
* Hannes Tschofenig 
* Lakshminath Dondeti
* Vidya Narayanan 

Please let me know if the above list is incomplete or incorrect. 

I guess we need a few other folks to join the discussion and to state
their opinion. 

Ciao
Hannes
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 25 Jan 2009 12:48:44 -0800

>I guess we need a few other folks to join the discussion and to state

Yes, definitely. At this point, we have heard from two groups of authors; hearing from the wider implementers community would be valuable.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yoav Nir <[email-masked]>
Date: Mon, 26 Jan 2009 09:44:37 +0200

Paul Hoffman said:
> Yes, definitely. At this point, we have heard from two groups of authors;
> hearing from the wider implementers community would be valuable.

IMO it's six of one, half a dozen of another.  The choice here is between making the IKE_SA_INIT exchange more complex and adding a new, rather simple exchange.

Adding the ticket to the IKE_SA_INIT means that there are two paths in the IKE_SA_INIT code, and state must be kept to keep the two apart. This choice has the advantage, as Hui pointed out, that if the ticket is in the IKE_SA_INIT, you can fall back to regular IKE, saving us one round-trip in the weird and rare case that the gateway cannot use the ticket (the ticket store died? Key rolled over while the connection was down?)

A new exchange will involve more new lines of code, but the difference is not great, and this has the advantage of having both the IKE_SA_INIT and the IKE_RESUMPTION exchanges remain simple.

So I think both options are good, but if I have to choose, I would go with adding a new exchange, because two simple exchanges have a lesser potential for problems than one complex exchange.

Yoav

Email secured by Check Point
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Matthew Cini Sarreo <[email-masked]>
Date: Fri, 30 Jan 2009 09:45:58 +0100

I think that adding a new exchange would be better. This would allow an
implementation to just use a resumption exchange, and not use IKE_SA_INIT
and decide if it is to be used to create a new SA or for reconnection
purposes

.This will require far more lines of code as it was previously stated, but I
feel that this would be similar in structure to existing exchanges (how the
code is written to implement their functionality) and would be simple. This
way, implementers will "just" have to add a new exchange to their existing
code and not have to change an existing exchange.

I would say that keeping simple exchanges would be beneficial for IKE.

Regards,

Matthew

>> > >See http://www.ietf.org/mail-archive/web/ipsec/current/msg03356.htmland
>> > >follow ups.
>> > >"
>> > >
>> IMO it's six of one, half a dozen of another.  The choice here is between
>> making the IKE_SA_INIT exchange more complex and adding a new, rather simple
>> exchange.
>>
>> Adding the ticket to the IKE_SA_INIT means that there are two paths in the
>> IKE_SA_INIT code, and state must be kept to keep the two apart. This choice
>> has the advantage, as Hui pointed out, that if the ticket is in the
>> IKE_SA_INIT, you can fall back to regular IKE, saving us one round-trip in
>> the weird and rare case that the gateway cannot use the ticket (the ticket
>> store died? Key rolled over while the connection was down?)
>>
>> A new exchange will involve more new lines of code, but the difference is
>> not great, and this has the advantage of having both the IKE_SA_INIT and the
>> IKE_RESUMPTION exchanges remain simple.
>>
>> So I think both options are good, but if I have to choose, I would go with
>> adding a new exchange, because two simple exchanges have a lesser potential
>> for problems than one complex exchange.
>>
>> Yoav
>>