Subject: Re: [IPsec] [ipsecme] #114: Expired drafts, especially BEET

From: "Frankel, Sheila E." <[email-masked]>
Date: Tue, 27 Oct 2009 11:46:18 -0400

#114: Expired drafts, especially BEET

Proposed changes to Roadmap doc:

1) Sheila and Suresh do not advocate the addition of the BEET Internet Draft to this doc, so no change is required for that.

2) Add text to the introductory section for IKEv1, Section 4.1.1:

Additional text:

IKE is the preferred key management protocol for IPsec. It is used for peer authentication; to negotiate, modify and delete SAs;  and to negotiate authenticated keying material for use within those SAs.  The standard peer authentication methods used by IKEv1 (pre-shared secret keys and digital certificates) had several shortcomings related to use of IKEv1 to enable remote user authentication to a corporate VPN: it could not leverage the use of legacy authentication systems (e.g. RADIUS databases) to authenticate a remote user to a security gateway; and it could not be used to configure remote users with network addresses or other information needed in order to access the internal network. 

Two Internet Drafts were written to address these problems: Extended Authentication withn IKE (XAUTH) (draft-beaulieu-ike-xauth) and The ISAKMP Configuration Method (draft-dukes-ike-mode-cfg).  These drafts did not progress to RFC status due to security flaws and other problems related to these solutions. However, many current IKEv1 implementations incorporate aspects of these solutions to facilitate remote user access to corporate VPNs. Since these solutions were not standardized, there is no assurance that the implementations adhere fully to the suggested solutions, or that one implementation can interoperate with others that claim to incorporate the same features. Furthermore, these solutions have know security issues. Thus, use of these solutions is not recommended, and these Internet Drafts are not specified in this roadmap.
________________________________________
From: ipsecme issue tracker [[email-masked]]
Sent: Friday, October 16, 2009 8:29 PM
To: [email-masked]; Frankel, Sheila E.
Subject: [ipsecme] #114: Expired drafts, especially BEET

#114: Expired drafts, especially BEET
-----------------------------------+----------------------------------------
 Reporter:  paul.hoffman@…         |       Owner:  sheila.frankel@…
     Type:  defect                 |      Status:  new
 Priority:  normal                 |   Milestone:
Component:  roadmap                |    Severity:  -
 Keywords:                         |
-----------------------------------+----------------------------------------
 Sheila would like to see ESP BEET mode referenced, since it's more widely
 implemented than other docs that are mentioned. However, it is not on
 track to becoming an RFC.

 Also, there are some who want to mention other very widely implemented
 (expired) drafts which will never come out as RFCs, namely IKEv1
 configuration mode (draft-dukes-ike-mode-cfg-02) and IKEv1 xauth (draft-
 beaulieu-ike-xauth-02).

 RESPONSE: We will mention the expired drafts in the IKEv1 section of the
 roadmap doc, explaining that many implementations implement these 2 drafts
 to enable road warrior (user) authentication. The wording will include
 cautions about their use: security issues, implementation/interoperability
 problems, etc.

 Wording is needed.

--
Ticket URL: <http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/114>
ipsecme <http://tools.ietf.org/ipsecme/>

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 27 Oct 2009 18:13:48 +0200

I'm OK with this text. Typo: know => known in the last sentence.

	Yaron

> -----Original Message-----
> From: Frankel, Sheila E. [mailto:[email-masked]]
> Sent: Tuesday, October 27, 2009 17:46
> To: [email-masked]
> Cc: Paul Hoffman; Yaron Sheffer; [email-masked]; Tero
> Kivinen
> Subject: RE: [ipsecme] #114: Expired drafts, especially BEET
> 
> 
> 1) Sheila and Suresh do not advocate the addition of the BEET Internet
> Draft to this doc, so no change is required for that.
> 
> IKE is the preferred key management protocol for IPsec. It is used for
> peer authentication; to negotiate, modify and delete SAs;  and to
> negotiate authenticated keying material for use within those SAs.  The
> standard peer authentication methods used by IKEv1 (pre-shared secret keys
> and digital certificates) had several shortcomings related to use of IKEv1
> to enable remote user authentication to a corporate VPN: it could not
> leverage the use of legacy authentication systems (e.g. RADIUS databases)
> to authenticate a remote user to a security gateway; and it could not be
> used to configure remote users with network addresses or other information
> needed in order to access the internal network.
> 
> Two Internet Drafts were written to address these problems: Extended
> Authentication withn IKE (XAUTH) (draft-beaulieu-ike-xauth) and The ISAKMP
> Configuration Method (draft-dukes-ike-mode-cfg).  These drafts did not
> progress to RFC status due to security flaws and other problems related to
> these solutions. However, many current IKEv1 implementations incorporate
> aspects of these solutions to facilitate remote user access to corporate
> VPNs. Since these solutions were not standardized, there is no assurance
> that the implementations adhere fully to the suggested solutions, or that
> one implementation can interoperate with others that claim to incorporate
> the same features. Furthermore, these solutions have know security issues.
> Thus, use of these solutions is not recommended, and these Internet Drafts
> are not specified in this roadmap.
>  Reporter:  paul.hoffman@...         |       Owner:  sheila.frankel@...
> Scanned by Check Point Total Security Gateway.

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 27 Oct 2009 13:19:35 -0700

At 11:46 AM -0400 10/27/09, Frankel, Sheila E. wrote:
>Two Internet Drafts were written to address these problems: Extended Authentication withn IKE (XAUTH) (draft-beaulieu-ike-xauth) and The ISAKMP Configuration Method (draft-dukes-ike-mode-cfg). 

I would prefer:

Many Internet Drafts were written to address these problems in different ways. Two that were adopted by many vendors were Extended Authentication withn IKE (XAUTH) (draft-beaulieu-ike-xauth) and The ISAKMP Configuration Method (draft-dukes-ike-mode-cfg).

--Paul Hoffman, Director
--VPN Consortium

---

From: Tero Kivinen <[email-masked]>
Date: Wed, 28 Oct 2009 14:11:17 +0200

> 2) Add text to the introductory section for IKEv1, Section 4.1.1:
...
> Authentication withn IKE (XAUTH) (draft-beaulieu-ike-xauth) and The
		     ^
within

> ISAKMP Configuration Method (draft-dukes-ike-mode-cfg).  These
> drafts did not progress to RFC status due to security flaws and
> other problems related to these solutions. However, many current
> IKEv1 implementations incorporate aspects of these solutions to
> facilitate remote user access to corporate VPNs. Since these
> solutions were not standardized, there is no assurance that the
> implementations adhere fully to the suggested solutions, or that one
> implementation can interoperate with others that claim to
> incorporate the same features. Furthermore, these solutions have
> know security issues. Thus, use of these solutions is not
> recommended, and these Internet Drafts are not specified in this
> roadmap.

I wonder if we should also say that different implementations took
different versions of the drafts (and their predecessors
draft-ietf-ipsra-isakmp-xauth and draft-ietf-ipsec-isakmp-mode-cfg)
and those different versions are NOT necessarely interoperable which
each other.

Actually listing also those predecessor drafts might be good idea as
implementations done before year 2000 mostly refer to them, and we are
talking about old expired drafts to obsoleted protocol, so most likely
people using them are not from this centrury :-)
-- 
[email-masked]