Subject: [IPsec] Relating the two ESP-null documents

From: Yaron Sheffer <[email-masked]>
Date: Tue, 11 Aug 2009 16:03:44 +0300

Hi,

As we near publication of the WESP and Heuristics drafts, we'd like to make
sure that the WG consensus is clearly expressed in both documents. So we
propose to include the following note as a section in both documents. Please
let us know if this works for you:

-- begin text

Applicability: Heuristic Traffic Inspection and Wrapped ESP
-----------------------------------------------------------

There are two ways to enable intermediate security devices to distinguish
between encrypted and unencrypted ESP traffic:

- The heuristics approach [heuristics I-D] has the intermediate node inspect
the unchanged ESP traffic, to determine with extremely high probability
whether or not the traffic stream is encrypted.

- The Wrapped ESP approach [WESP I-D], in contrast, requires the ESP
endpoints to be modified to support the new protocol. WESP allows the
intermediate node to distinguish encrypted and unencrypted traffic
deterministically, using a simpler implementation for the intermediate node.

Both approaches are being documented simultaneously by the IPsecME Working
Group, with WESP being put on Standards Track while the heuristics approach
is being published as an Informational RFC. While endpoints are being
modified to adopt WESP, we expect both approaches to coexist for years,
because the heuristic approach is needed to inspect traffic where at least
one of the endpoints has not been modified. In other words, intermediate
nodes are expected to support both approaches in order to achieve good
security and performance during the transition period.

-- end text 

[Note: both references are non-normative.]

Currently both documents have direct or indirect references to one another,
but they are not exactly in line with the consensus we have reached. In both
cases the emphasis is on the two solutions competing with one another,
rather than complementing each other.

Thanks,
	Yaron

---

From: "Grewal, Ken" <[email-masked]>
Date: Tue, 18 Aug 2009 10:32:32 -0600

Works for me!

Thanks, 
- Ken

>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf
>Of Yaron Sheffer
>Sent: Tuesday, August 11, 2009 6:04 AM
>To: [email-masked]
>Subject: [IPsec] Relating the two ESP-null documents
>
>Hi,
>

---

From: "Bhatia, Manav (Manav)" <[email-masked]>
Date: Wed, 19 Aug 2009 06:31:28 +0530

Works for me too!

Cheers, Manav 

> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Grewal, Ken
> Sent: Tuesday, August 18, 2009 10.03 PM
> To: Yaron Sheffer; [email-masked]
> Subject: Re: [IPsec] Relating the two ESP-null documents
> 
> Works for me!
> 
> Thanks, 
> - Ken
>  
> 
> >As we near publication of the WESP and Heuristics drafts, 
> we'd like to
> >make
> >deterministically, using a simpler implementation for the 
> intermediate
> >node.
> >
> >but they are not exactly in line with the consensus we have 
> reached. In
> >both
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec
>

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 24 Aug 2009 15:50:56 +0300

> let us know if this works for you:

I think that applicability statement is good, and acceptable.

Sorry about the delay for answering, but I wanted to re-read the
draft-ietf-ipsecme-traffic-visibility draft once more before answering
(my comments to it will follow).

> Applicability: Heuristic Traffic Inspection and Wrapped ESP

So would this text be added to both documents or what? If so where
(between section 2 and 3 in esp-null-heuristics and after or replacing
section 1.2 of traffic-visibility draft)?
-- 
[email-masked]

---

From: Yaron Sheffer <[email-masked]>
Date: Mon, 24 Aug 2009 17:07:43 +0300

Hi Tero,

Thanks for approving this text. I was expecting each draft's editor team to
decide where to add it into their draft.

Best,
	Yaron

> From: Tero Kivinen [mailto:[email-masked]]
> Sent: Monday, August 24, 2009 15:51
> To: Yaron Sheffer
> Cc: [email-masked]
> Scanned by Check Point Total Security Gateway.

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 24 Aug 2009 10:09:53 -0700

At 3:50 PM +0300 8/24/09, Tero Kivinen wrote:
>So would this text be added to both documents or what?

It should go in both. That way, an implementer a year from now who comes across one of the RFCs will both find out about the other and be clear on the relationship.

>If so where

My preference for esp-null-heuristics is that this applicability statement be section 1.1, and that what is now section 2 (the 2119 language) become section 1.2.

--Paul Hoffman, Director
--VPN Consortium