Subject: [IPsec] Issue #176: What to do with a proposal of NONE

From: Paul Hoffman <[email-masked]>
Date: Sat, 6 Mar 2010 17:11:39 -0800

<http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/176>

Pasi says:

Section 3.3.6 says "If one of the proposals offered is for the Diffie-Hellman group of NONE, the responder MUST ignore the initiator's KE payload and omit the KE payload from the response."

This seems wrong: it seems to say that if the initiator proposes DH group NONE, the responder must select it.

However, negotiation of DH groups and KE payload is already well described in Sections 1.2 and 1.3 (paragraphs mentioning INVALID_KE_PAYLOAD), and it seems the last paragraph of 3.3.6 is completely redundant. Thus, I'd propose just deleting the whole paragraph.

Paul says:

That whole paragraph has been there since -00. Only the last sentence was added in -03 almost a year ago. It was added to fix <http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/6>, but I can easily believe that fix was not correct. However, sections 1.2 and 1.3 don't address the issue in the sentence quoted.

--Paul Hoffman, Director
--VPN Consortium

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 8 Mar 2010 17:10:22 +0200

Paul Hoffman writes:
> Section 3.3.6 says "If one of the proposals offered is for the
> Diffie-Hellman group of NONE, the responder MUST ignore the
> initiator's KE payload and omit the KE payload from the response." 
> 
> However, negotiation of DH groups and KE payload is already well
> described in Sections 1.2 and 1.3 (paragraphs mentioning
> INVALID_KE_PAYLOAD), and it seems the last paragraph of 3.3.6 is
> completely redundant. Thus, I'd propose just deleting the whole
> paragraph. 
> 
> Paul says:
> 
> That whole paragraph has been there since -00. Only the last
> sentence was added in -03 almost a year ago. It was added to fix
> <http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/6>, but I can
> easily believe that fix was not correct. However, sections 1.2 and
> 1.3 don't address the issue in the sentence quoted. 

The last sentence is the one that is misleading. All of the rest of
the paragraph is just repeation of the text from elsewhere.

The last sentence should be saying:

		  If one of the proposals offered is for the
   Diffie-Hellman group of NONE, and the responder selects that
   Diffie-Hellman group, then it MUST ignore the initiator's KE
   payload and omit the KE payload from the response.

I.e. the MUST ignore, and omit the KE payload is only applicable if
responder actually selects the Diffie-Hellman group NONE. 
-- 
[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 8 Mar 2010 07:20:06 -0800

>responder actually selects the Diffie-Hellman group NONE.

That makes good sense to me, and seems like less of a change to 4306 than the current wording. Do others agree?

--Paul Hoffman, Director
--VPN Consortium

---

From: David Wierbowski <[email-masked]>
Date: Mon, 8 Mar 2010 12:55:32 -0500

I agree.

  From:       Paul Hoffman <[email-masked]>                                           
                                                                                             
  To:         Tero Kivinen <[email-masked]>                                                  
                                                                                             
  Cc:         IPsecme WG <[email-masked]>, Pasi Eronen <[email-masked]>               
                                                                                             
  Date:       03/08/2010 10:22 AM                                                            
                                                                                             
  Subject:    Re: [IPsec] Issue #176: What to do with a proposal of NONE                     
                                                                                             
  Sent by:    [email-masked]                                                         

At 5:10 PM +0200 3/8/10, Tero Kivinen wrote:
>> This seems wrong: it seems to say that if the initiator proposes DH
group NONE, the responder must select it.
>responder actually selects the Diffie-Hellman group NONE.

That makes good sense to me, and seems like less of a change to 4306 than
the current wording. Do others agree?

--Paul Hoffman, Director
--VPN Consortium
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Mon, 8 Mar 2010 22:54:52 +0200

Me too.
________________________________________
From: [email-masked] [[email-masked]] On Behalf Of David Wierbowski [[email-masked]]
Sent: Monday, March 08, 2010 19:55
To: Paul Hoffman
Cc: IPsecme WG; [email-masked]
Subject: Re: [IPsec] Issue #176: What to do with a proposal of NONE

I agree.

--Paul Hoffman, Director
--VPN Consortium

Scanned by Check Point Total Security Gateway.

---

From: <[email-masked]>
Date: Tue, 9 Mar 2010 12:52:43 +0100

> responder actually selects the Diffie-Hellman group NONE.

This looks correct to me.

Best regards,
Pasi