Subject: [IPsec] Review of PF_KEY extension

From: "Laganier, Julien" <[email-masked]>
Date: Wed, 20 Oct 2010 09:40:45 -0700

Folks,

We are trying to get this PF_KEY extension document published as an Informational RFC and it would be beneficial if some IPsec experts on this list could help us by reviewing the document.

Please let me know if you are willing to review the document. 

Thanks.

--julien

PF_KEY Extension as an Interface between Mobile IPv6 and IPsec/IKE
              draft-ebalard-mext-pfkey-enhanced-migrate-01

Abstract

   This document describes the need for an interface between Mobile IPv6
   and IPsec/IKE and shows how the two protocols can interwork.  An
   extension of the PF_KEY framework is proposed which allows smooth and
   solid operation of IPsec/IKE in a Mobile IPv6 environment.

   PF_KEY MIGRATE message serves as a carrier for updated information
   for both the in-kernel IPsec structures (Security Policy Database /
   Security Association Database) and those maintained by the key
   managers.  This includes in-kernel Security Policy / Security
   Association endpoints, key manager maintained equivalents, and
   addresses used by IKE_SA (current and to be negotiated).  The
   extension is helpful for assuring smooth interworking between Mobile
   IPv6 and IPsec/IKE for the bootstrapping of mobile nodes and their
   movements.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 20 Oct 2010 20:01:35 +0300

A review from an IPsec implementation perspective would indeed be much 
appreciated.

For background, my AD review is here 
http://www.ietf.org/mail-archive/web/mext/current/msg04450.html

Jari

---

From: [email-masked] (Arnaud Ebalard)
Date: Wed, 20 Oct 2010 21:59:15 +0200

Hi,

> A review from an IPsec implementation perspective would indeed be much

Yes. 

> http://www.ietf.org/mail-archive/web/mext/current/msg04450.html

My reply to those comments is in the thread pointed by Jari:

 http://www.ietf.org/mail-archive/web/mext/current/msg04453.html

The latest of version of the draft (including corrections associated
with Jari's comments) is here (in txt or xml):

  http://hg.natisbad.org/migrate2_draft/file/

I will wait for additional comments before making it a v2.

Cheers,

a+