Subject: [IPsec] I-D Action:draft-ietf-ipsecme-failure-detection-01.txt

From: [email-masked]
Date: Sun, 10 Oct 2010 01:30:25 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IP Security Maintenance and Extensions Working Group of the IETF.

	Title           : A Quick Crash Detection Method for IKE
	Author(s)       : Y. Nir, et al.
	Filename        : draft-ietf-ipsecme-failure-detection-01.txt
	Pages           : 22
	Date            : 2010-10-10

This document describes an extension to the IKEv2 protocol that
allows for faster detection of SA desynchronization using a saved
token.

When an IPsec tunnel between two IKEv2 peers is disconnected due to a
restart of one peer, it can take as much as several minutes for the
other peer to discover that the reboot has occurred, thus delaying
recovery.  In this text we propose an extension to the protocol, that
allows for recovery immediately following the restart.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-failure-detection-01.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Yoav Nir <[email-masked]>
Date: Sun, 10 Oct 2010 10:55:10 +0200

Hi all

This version resolves issues #189, #190, #191, and #192. 

Also the content of section 9.3 has been moved to section 10.4 because, as Frederic pointed out, it's more a security considerations than operational.

Yoav

On Oct 10, 2010, at 10:30 AM, <[email-masked]> <[email-masked]> wrote:

> <draft-ietf-ipsecme-failure-detection-01.url><ATT00002..txt>

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 10 Oct 2010 15:00:26 +0200

There's a typo in Sec. 3, "These are the final IKE_AUTH request..." 
should be "the first".

More importantly, I think this new text is a bit wimpy... "To ensure 
this, token makers MUST use a good pseudo-random number generator to 
generate the IKE SPIs." I would have preferred "To ensure this, token 
makers MUST generate unpredictable IKE SPIs by using a cryptographically 
strong pseudo-random number generator."

Thanks,
	Yaron

On 10/10/2010 10:55 AM, Yoav Nir wrote:
> On Oct 10, 2010, at 10:30 AM,<[email-masked]>  <[email-masked]>  wrote:
>
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec