Subject: [IPsec] I-D ACTION:draft-ietf-ipsecme-ikev2bis-11.txt

From: [email-masked]
Date: Mon, 17 May 2010 13:45:02 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts 
directories.
This draft is a work item of the IP Security Maintenance and Extensions Working Group of the IETF.

	Title		: Internet Key Exchange Protocol: IKEv2
	Author(s)	: C. Kaufman, P. Hoffman, Y. Nir, P. Eronen
	Filename	: draft-ietf-ipsecme-ikev2bis-11.txt
	Pages		: 130
	Date		: 2010-5-17
	
This document describes version 2 of the Internet Key Exchange (IKE)
   protocol.  IKE is a component of IPsec used for performing mutual
   authentication and establishing and maintaining security associations
   (SAs).  This document replaces and updates RFC 4306, and includes all
   of the clarifications from RFC 4718.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-ikev2bis-11.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Sean Turner <[email-masked]>
Date: Mon, 17 May 2010 17:07:01 -0400

> http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-ikev2bis-11.txt

Note that during this update we considered the following errata:
http://www.rfc-editor.org/errata_search.php?eid=1671
http://www.rfc-editor.org/errata_search.php?eid=1672
http://www.rfc-editor.org/errata_search.php?eid=2190
http://www.rfc-editor.org/errata_search.php?eid=2191
http://www.rfc-editor.org/errata_search.php?eid=2192
http://www.rfc-editor.org/errata_search.php?eid=2193
http://www.rfc-editor.org/errata_search.php?eid=2194
http://www.rfc-editor.org/errata_search.php?eid=2195
http://www.rfc-editor.org/errata_search.php?eid=2196

1671, 1672, and 2196 were already reworded in ikev2bis.

2190 is not needed as it's covered in the next paragraph.

No one has reported problems with 2191, 2192, 2193, or 2194.

2195 seems reasonable, but there's been no discussion.

At this point, we believe there's no action required on these.  Please 
let me know very soon whether you see a problem with this course of 
action.

spt

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 17 May 2010 14:39:24 -0700

At 5:07 PM -0400 5/17/10, Sean Turner wrote:
>>A New Internet-Draft is available from the on-line Internet-Drafts directories.
>At this point, we believe there's no action required on these.  Please let me know very soon whether you see a problem with this course of action.

In specific, it would be good if the pickier folks on this list to look at 2195 and see if this is really just a clarification or is a change that limits something we don't want to limit. Comments on any of the others is welcome too.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman <[email-masked]>
Date: Mon, 17 May 2010 14:44:26 -0700

>http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-ikev2bis-11.txt

The change list for this draft is:

D.18.  Changes from draft-ietf-ipsecme-ikev2bis-10 to
       draft-ietf-ipsecme-ikev2bis-11

   Changes made during IESG review.

   In 1.7, changed "The clarifications are mostly based on [Clarif]" to
   "Many of the clarifications are based on [Clarif]".

   Added to 1.7: The small number of technical changes listed here are
   not expected to affect RFC 4306 implementations that have already
   been deployed at the time of publication of this document.

   Added to 3.3.4: At the time of publication of this document,
   [RFC4307] specifies these suites, but note that it might be updated
   in the future, and other RFCs might specify different sets of suites.

   In 8.1, added normative references for [HTTP], [RFC4307], and [URLS].

   Editorial: changed "elliptical curve" to "elliptic curve".

These were mostly to deal with requests from IESG members, and we should know shortly if they made the last one happy.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yaron Sheffer <[email-masked]>
Date: Tue, 18 May 2010 13:22:17 +0300

2195 looks like a clarification to me. And not an essential one either, 
because the attribute structure further down the section make it very 
clear that there's one type per attribute.

Thanks,
	Yaron

On 05/18/2010 12:39 AM, Paul Hoffman wrote:
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 18 May 2010 13:37:00 +0300

Paul Hoffman writes:
> In specific, it would be good if the pickier folks on this list to
> look at 2195 and see if this is really just a clarification or is a
> change that limits something we don't want to limit. Comments on any
> of the others is welcome too. 

I think the change in 2195 is ok, but unneeded, as Configuration
Attribute substructure has only on value (the field inside the
configuration attribute is called value, not values, thus
configuration attribute cannot have more than one value). So only way
to send multiple attribute values is to send multiple configuration
attribute structures inside one configuration payload.

But if someone though this is not clear enough, the change is
harmless, and can be done. 
-- 
[email-masked]