Subject: [IPsec] question about ESN and IANA registry

From: Scott C Moonen <[email-masked]>
Date: Wed, 11 Aug 2010 16:15:33 -0400

The IANA registry currently lists the ESN transform as optional for ESP, AH
in IKEv2.  From http://www.iana.org/assignments/ikev2-parameters:

Registry:
Transform
Type      Description                      Used In
Reference
--------  -------------------------------  ---------------------------
---------
. . .
5         Extended Sequence Numbers (ESN)  (Optional in AH and ESP)
[RFC-ietf-ipsecme-ikev2bis-11.txt]

However, both RFC 4306 and ikev2bis indicate that ESN is mandatory:

   Protocol    Mandatory Types          Optional Types
   ---------------------------------------------------
   IKE         ENCR, PRF, INTEG*, D-H
   ESP         ENCR, ESN                INTEG, D-H
   AH          INTEG, ESN               D-H

I believe the registry is in error and I'm hoping that posting here is an
effective way to suggest a fix.  Thanks,

Scott Moonen ([email-masked])
z/OS Communications Server TCP/IP Development
http://www.linkedin.com/in/smoonen

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 11 Aug 2010 14:16:47 -0700

At 4:15 PM -0400 8/11/10, Scott C Moonen wrote:
>The IANA registry currently lists the ESN transform as optional for ESP, AH in IKEv2. From <http://www.iana.org/assignments/ikev2-parameters:>http://www.iana.org/assignments/ikev2-parameters:
>
>Registry:
>Transform
>Type Description Used In Reference
>-------- ------------------------------- --------------------------- ---------
>. . .
>5 Extended Sequence Numbers (ESN) (Optional in AH and ESP) [RFC-ietf-ipsecme-ikev2bis-11.txt]
>
>I believe the registry is in error and I'm hoping that posting here is an effective way to suggest a fix. Thanks,

I agree that support for ESN is required in both AH and ESP, even if it is only to say "No ESN" in the proposals.

--Paul Hoffman, Director
--VPN Consortium

---

From: Tero Kivinen <[email-masked]>
Date: Mon, 16 Aug 2010 15:29:08 +0300

> in IKEv2.  From http://www.iana.org/assignments/ikev2-parameters:

There has been lots of different interpretations whether including ESN
of none to the proposal or not (if that is the only one that is
supported).

Those were seen in the interop events just before RFC4306 was
published, and if I remember correctly there was some late changes
text changes to the RFC4306 because of this. If you check
draft-ietf-ipsec-ikev2-17.txt that still contains text saying:

    Extended Sequence Numbers (ESN) 5 (Optional in AH and ESP)

This was changed to 

    Extended Sequence Numbers (ESN) 5 (AH and ESP)

before the RFC was published:

http://tools.ietf.org/rfcdiff?url2=rfc4306

There was poll on the ipsec list on 04 Mar 2005:

http://www.ietf.org/mail-archive/web/ipsec/current/msg01367.html

about this and the solution was to change the ESN transform to
mandatory. This change was done while the document was still in RFC
editor queue, so this means the IANA might have already taken the
older version and created the registry based on that.

So this is clearly a error, and I will send request to IANA to fix
this. 
-- 
[email-masked]