Subject: [IPsec] IESG DISCUSS re: IKEv2-bis and RFC 4307

From: Yaron Sheffer <[email-masked]>
Date: Sat, 08 May 2010 23:54:57 +0300

Hi everyone,

There is a DISCUSS position from an IESG member on the ikev2bis document 
that says:

>The Gen-ART Review by Elwyn Davies on 4 May 2010 raised a question
>that deserves consideration.  Elwyn said:
>>
>> s3.3.4: The draft states that the list of mandatory to implement
>> suites has been removed due to evolution going too fast.  However
>> there are effectively some mandatory to implement suites; they are
>> listed in other documents.  There should be a way of finding them
>> so that users and implmenters can find them easily.
>>
>Inclusion of a informative reference seems reasonable.  There could be
>warning that the algorithm document is likely to be updated without
>a corresponding update to the protocol.  The RFC index will tell the
>community when the algorithm document is revised.

The previous WG chose not to put any reference to RFC 4307 into RFC 
4306, so this would be a change. Having said that, adding a reference is 
not much of a change. Proposed wording for 3.3.4 would be:

CURRENT:
    The specification of suites that MUST and SHOULD be supported for
    interoperability has been removed from this document because they are
    likely to change more rapidly than this document evolves.

PROPOSED:
    The specification of suites that MUST and SHOULD be supported for
    interoperability is not included this document because they are
    likely to change more rapidly than this document evolves. At
    the time of publication of this document, [RFC 4307] specifies
    these suites, but note that it might be updated in the future, and
    other RFCs might specify different sets of suites.

RFC 4307 would be listed as a normative reference.

Please note that we are going one better than Elwyn's comment, in adding 
4307 as a normative, rather than informational, reference. Is there any 
objection in the WG to this change?

Thanks,
	Yaron

---

From: Yoav Nir <[email-masked]>
Date: Sun, 9 May 2010 09:13:38 +0300

I'm fine with the change, and with the reference being either normative or informative. I prefer informative, though.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Yaron Sheffer
Sent: Saturday, May 08, 2010 11:55 PM
To: IPsecme WG
Subject: [IPsec] IESG DISCUSS re: IKEv2-bis and RFC 4307

Hi everyone,

CURRENT:

PROPOSED:

Thanks,
	Yaron

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

Scanned by Check Point Total Security Gateway.

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 9 May 2010 07:44:16 -0700

>I'm fine with the change, and with the reference being either normative or informative. I prefer informative, though.

+1 to being fine with either and preferring informative.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 09 May 2010 23:46:34 +0300

Hi Yoav,

RFC 4306 is the main specification for IKEv2, and RFC 4307 provides 
details that are necessary to implement IKEv2 in an interoperable 
manner. So why do you think that an Informative reference is more 
appropriate here?

The relevant background, FWIW, is 
http://www.ietf.org/iesg/statement/normative-informative.html.

Thanks,
	Yaron

---

From: Paul Hoffman <[email-masked]>
Date: Sun, 9 May 2010 14:13:09 -0700

At 11:46 PM +0300 5/9/10, Yaron Sheffer wrote:
>RFC 4306 is the main specification for IKEv2, and RFC 4307 provides details that are necessary to implement IKEv2 in an interoperable manner. So why do you think that an Informative reference is more appropriate here?
>
>The relevant background, FWIW, is http://www.ietf.org/iesg/statement/normative-informative.html.

The information in RFC 4307 is not required in order to implement the protocol in RFC 4306. It is required to interoperate in the most general sense only, that is, to interoperate with partners with whom you do not have prior arrangements. Some can read RFC 4306 without RFC 4307 and make an implementation that will interoperate just fine between organizations that communicate about their crypto preferences. Thus, the information in 4307 is informative but, if it makes you happy to make it a normative reference, there is no problem with that.

Note that Russ Housley has a valid reason for asking for the reference to 4307 to be informative: other security protocols such as S/MIME have their 4307-equivalents as informative references.

--Paul Hoffman, Director
--VPN Consortium