Subject: [IPsec] Is IKEv2 mandatory to implement?

From: Thomas Narten <[email-masked]>
Date: Thu, 29 Apr 2010 14:53:51 -0400

I'm looking at revising RFC 4294 (IPv6 Node Requirements), to update
its security section. (e.g., see draft-ietf-6man-node-req-bis-04.txt)

RFC 4294 (based on what I understand and recall the thinking to be at
the time) mandated IPsec (ESP/AH), but only made IKEv2 a SHOULD.

But, it's been pointed out to me that RFC 4301 actually says:

>    10.  Conformance Requirements
> 
>    All IPv4 IPsec implementations MUST comply with all requirements of
>    this document.  All IPv6 implementations MUST comply with all
>    requirements of this document.

And earlier:

>    Because most of the security services provided by IPsec require the
>    use of cryptographic keys, IPsec relies on a separate set of
>    mechanisms for putting these keys in place.  This document requires
>    support for both manual and automated distribution of keys.  It
>    specifies a specific public-key based approach (IKEv2 [Kau05]) for
>    automated key management, but other automated key distribution
>    techniques MAY be used.

This implies IKEv2 is a MUST, but doesn't quite say it. This text is
taken from Section 3, "System Overview", rather than elsewhere, where
it might be considered less normative.

Is there more specific wording in 4301 on this point? Is it viewed as
an absolute MUST requirement to implement IKEv2 in order to claim
compliance with RFC4301?

Thomas

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 30 Apr 2010 11:47:39 +0300

> an absolute MUST requirement to implement IKEv2 in order to claim

RFC4301 says in section 4.5:
----------------------------------------------------------------------
4.5.  SA and Key Management

   All IPsec implementations MUST support both manual and automated SA
   and cryptographic key management.  ...
...

4.5.2.  Automated SA and Key Management

   Widespread deployment and use of IPsec requires an Internet-standard,
   scalable, automated, SA management protocol.  Such support is
   required to facilitate use of the anti-replay features of AH and ESP,
   and to accommodate on-demand creation of SAs, e.g., for user- and
   session-oriented keying.  (Note that the notion of "rekeying" an SA
   actually implies creation of a new SA with a new SPI, a process that
   generally implies use of an automated SA/key management protocol.)

   The default automated key management protocol selected for use with
   IPsec is IKEv2 [Kau05].  This document assumes the availability of
   certain functions from the key management protocol that are not
   supported by IKEv1.  Other automated SA management protocols MAY be
   employed.
...
----------------------------------------------------------------------

I.e. automated key management is mandatory, but the automated key
management protocol can also be something else than IKEv2, but for
example IKEv1 is NOT enough, as certain functions required by RFC4301
are missing.

I do not think there currently exists any other automated key
management protocol that could be used for RFC4301 than IKEv2. 
-- 
[email-masked]