Subject: [IPsec] Some comments concerning draft-amjads-ipsecme-ikev2-data-channel-00.txt

From: "Valery Smyslov" <[email-masked]>
Date: Wed, 23 Oct 2013 17:38:22 +0400

Hi,

I have some comments concerning the draft.

1. As far as I understand, only one data channel can be created
    within one IKE SA. So, if application needs several different channels,
    it have to create several separate IKE SAs, performing authentication
    several times (probably involving human activity, if EAP is used).
    This is makes the whole architecture not so lightweight.

2. Nothing is said abouth channel deletion. I presume it exists
    untill IKE SA is deleted, right?

3. Could this IKE SA be used for other purposes,
    for example to create Child SAs as usual,
    or it must be explicitely dedicated to IKE Data channel?

4. In Section 8.1 in description of Protocol ID:
    according to RFC5996 this field MUST be zero
    if SPI Size field is zero.

Regards,
Valery Smyslov.

---

From: "Rajeshwar Singh Jenwar (rsj)" <[email-masked]>
Date: Thu, 24 Oct 2013 15:42:37 +0000

Hi Valery,

Thanks for your comments. Please see my replies inline [RSJ]

Kind Regards,
Raj

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Valery Smyslov
Sent: Wednesday, October 23, 2013 7:08 PM
To: Rajeshwar Singh Jenwar (rsj); [email-masked]
Subject: [IPsec] Some comments concerning draft-amjads-ipsecme-ikev2-data-channel-00.txt

Hi,

[RSJ]  Most of deployment use only single IPsec SA per peer, either
            They want to use security for all data for a peer/network or don't.
            The network for which we don't want security protection can be excluded using Access Control Lists (ACLs).
            So, in deployment where different application want to use IKEv2 data channel, we can use same IKEv2 SA for same peer for different application.  
           We are working on how to multiplex different applications using single IKEv2 SA, currently, we are thinking of using  adding source and destination
           Port in IKEv2 data channel payload.   

[RSJ] Right. It is coupled with life of IKEv2 SA.

[RSJ] Good Point. With IKEv2 data channel IKE_AUTH will not have IPsec payloads.
          But don't see any reason why this SA can't be used to create child SAs using CREATE_CHILD_SA exchange.

[RSJ] There is some confusion as per Sec 3.10, it is not very clear. 

Regards,
Valery Smyslov. 

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Thu, 24 Oct 2013 08:53:26 -0700

As a note to the WG, I asked Raj to turn in a revised draft which covered some of the points that Valery and others have made. Given the number of questions asked so far, I would prefer that the WG hold off on discussing this draft until there is a new, clarified draft.

--Paul Hoffman

---

From: "Rajeshwar Singh Jenwar (rsj)" <[email-masked]>
Date: Thu, 24 Oct 2013 16:01:18 +0000

Sure Paul, We will submit revised version soon.

Kind Regards,
Raj

-----Original Message-----
From: Paul Hoffman [mailto:[email-masked]] 
Sent: Thursday, October 24, 2013 9:23 PM
To: Rajeshwar Singh Jenwar (rsj)
Cc: [email-masked]
Subject: Re: [IPsec] Some comments concerning draft-amjads-ipsecme-ikev2-data-channel-00.txt

--Paul Hoffman

---

From: "Valery Smyslov" <[email-masked]>
Date: Fri, 25 Oct 2013 10:02:16 +0400

Hi Raj,

>             The network for which we don't want security protection can be 
> excluded using Access Control Lists (ACLs).
>             So, in deployment where different application want to use 
> IKEv2 data channel, we can use same IKEv2 SA
>             for same peer for different application.
>            We are working on how to multiplex different applications using 
> single IKEv2 SA, currently, we are thinking of
>            using  adding source and destination Port in IKEv2 data channel 
> payload.

To clarify my comment - I meant that your draft allows to create data 
channels
with different properties - aknowledged  unacknowledged, integrity only etc.
Different applications will need different properties. If you create only 
one
data channel per IKE SA, its properties won't probably satisfy all 
applications
that need it. So you will need to create several IKE SA.

But let's wait for next version of the draft.

Regards,
Valery.