Subject: [IPsec] Working Group Last Call: draft-kivinen-ipsecme-ikev2-rfc5996bis-01

From: Yaron Sheffer <[email-masked]>
Date: Wed, 23 Oct 2013 20:20:39 +0300

Hi, this is to start a 3-week working group last call on the IKEv2-bis 
(or -bis-bis) document, ending Nov. 13.

The draft is at: 
http://tools.ietf.org/html/draft-kivinen-ipsecme-ikev2-rfc5996bis. 
<http://tools.ietf.org/html/draft-kivinen-ipsecme-ikev2-rfc5996bis-01> 
The main motivation behind the draft is to progress IKEv2 from Proposed 
Standard to Internet Standard based on its broad industry adoption, and 
with a minimal number of changes. See RFC 6410 for the process details. 
We are planning to progress a couple other of our foundational RFCs in 
the near future.

Please read this draft and send any comments to the WG mailing list, 
even if the comments are "I see no problems". Comments such as "I do not 
understand this part" or "this part could be explained better in this 
way" are particularly useful at this point. Please pay special attention 
to differences from RFC 5996, as listed in Sec. 1.8.

Thanks,
     Paul and Yaron

---

From: Pasi Eronen <[email-masked]>
Date: Thu, 31 Oct 2013 09:56:44 +0200

I have reviewed the diffs from RFC 5996 to rfc5996bis-01, and I'm fine with
them.

Best regards,
Pasi

On Wed, Oct 23, 2013 at 8:20 PM, Yaron Sheffer <[email-masked]>wrote:

> Hi, this is to start a 3-week working group last call on the IKEv2-bis (or
> -bis-bis) document, ending Nov. 13.
>
> The draft is at: http://tools.ietf.org/html/**draft-kivinen-ipsecme-ikev2-
> **rfc5996bis<http://tools.ietf.org/html/draft-kivinen-ipsecme-ikev2-rfc5996bis>.
> <http://tools.ietf.org/html/**draft-kivinen-ipsecme-ikev2-**rfc5996bis-01<http://tools.ietf.org/html/draft-kivinen-ipsecme-ikev2-rfc5996bis-01>>
> with a minimal number of changes. See RFC 6410 for the process details. We
> are planning to progress a couple other of our foundational RFCs in the
> near future.
>
> Please read this draft and send any comments to the WG mailing list, even
> if the comments are "I see no problems". Comments such as "I do not
> understand this part" or "this part could be explained better in this way"
> are particularly useful at this point. Please pay special attention to
> differences from RFC 5996, as listed in Sec. 1.8.
>
> Thanks,
>     Paul and Yaron
>
> ______________________________**_________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/**listinfo/ipsec<https://www.ietf.org/mailman/listinfo/ipsec>
>

---

From: Yaron Sheffer <[email-masked]>
Date: Thu, 31 Oct 2013 10:42:05 +0200

<WG chair hat off, author hat on>

Hi Tero,

I think RFC 6989 (additional tests when reusing DH values) should be a 
normative reference, and the text at the bottom of 2.12 should be 
strengthened to something like:

In such cases, additional tests defined in [RFC6989] MUST be performed 
by the IKE peers. See this document, as well as [REUSE] for a security 
analysis of this practice.

Rationale: even if EC groups (and the "DSA groups") are not defined in 
RFC 5996, they are a mainstream use case and the RFC 6989 tests are 
security critical for them. Also, process-wise, RFC 6989 is a Standards 
Track document so the normative reference is legit.

Small typo: in Sec. 3.3.2, "do not need" -> "does not need", and "needs 
to have" -> "need to have".

<switch hats now>

Thanks,
	Yaron