Subject: [IPsec] Issue #42: Improve example of multiple proposals

From: Yaron Sheffer <[email-masked]>
Date: Tue, 3 Mar 2009 20:18:01 +0200

3.3. Security Association Payload

...

The Proposal structure contains within it a Proposal # and an IPsec protocol ID. Each structure MUST have a proposal number one (1) greater than the previous structure. The first Proposal in the initiator's SA payload MUST have a Proposal # of one (1). A proposal of AH or ESP would have two proposal structures, one for AH with Proposal #1<http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/1> and one for ESP with Proposal #2<http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/2>.

Tero:

I think the last sentence should be removed, as it is bit confusing and some people might read it 'AH and ESP' and interpret it as bundles. I do not really consider AH or ESP style proposal that common to require example here. Perhaps ESP with combined mode ciphers and ESP with normal ciphers + integrity algorithms would make better example.

Paul: Not done. The current example is clearer than your proposed change because few people understand combined modes, even if the current example is far-fetched. A different, clearer example would be a good replacement for the current text.
Yaron: a new proposal example would be appreciated!

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 4 Mar 2009 14:39:40 +0200

> Yaron: a new proposal example would be appreciated!

I provide replacement text at in the thread starting at 2008-09-23
15:52 (message id <[email-masked]>).

here is link to the thread: http://thread.gmane.org/gmane.ietf.ipsec/8317
-- 
[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 4 Mar 2009 10:01:17 -0800

>here is link to the thread: http://thread.gmane.org/gmane.ietf.ipsec/8317

You also followed it up later with a much longer example that I thought confused things.

I'm fine with the idea of taking out the "ESP or AH" part; I'm OK with your replacement if the rest of the WG is. Do people find the following reasonable?

The Proposal structure contains within it a Proposal # and an IPsec
protocol ID. Each structure MUST have a proposal number that is one
greater than the previous structure. The first Proposal in the
initiator's SA payload MUST have a Proposal # of 1. The main reason
to use multiple proposals is when using combined-mode ciphers.
Combined-mode ciphers include both integrity and encryption in single
encryption algorithm. Because of this, it is not allowed to have
combined mode ciphers with an another integrity algorithm, and thus a
proposal MUST NOT have any integrity algorithms other than NONE. If
the initiator wants to propose both combined-mode ciphers and normal
ciphers, it must include two proposals. One proposal will have all
combined-mode ciphers and no integrity algorithm. The other proposal
will have all non-combined-mode ciphers and all the allowed integrity
algorithms. For example, such proposal could have two proposal
structures, one for ESP with ENCR_AES-CCM_8, ENCR_AES-CCM_12, and
ENCR_AES-CCM_16 as Proposal #1 and one for ESP with ENCR_AES_CBC,
ENCR_3DES, AUTH_AES_XCBC_96, and AUTH_HMAC_SHA1_96 as Proposal #2.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yaron Sheffer <[email-masked]>
Date: Thu, 5 Mar 2009 00:01:10 +0200

Editorial: in "Combined-mode ciphers include both integrity and encryption in single encryption algorithm", strike out the second "encryption" or replace it by "cryptographic".

Thanks,
	Yaron

> -----Original Message-----
> From: Paul Hoffman [mailto:[email-masked]]
> Sent: Wednesday, March 04, 2009 20:01
> To: Tero Kivinen; Yaron Sheffer
> Cc: [email-masked]
> Subject: Re: [IPsec] Issue #42: Improve example of multiple proposals
> 
> I'm fine with the idea of taking out the "ESP or AH" part; I'm OK with
> your replacement if the rest of the WG is. Do people find the following
> reasonable?
> 
> Scanned by Check Point Total Security Gateway.
> 
> Scanned by Check Point Total Security Gateway.

Email secured by Check Point