Subject: Re: [IPsec] New Version Notification for draft-smyslov-ipsecme-ikev2-aux-02.txt

From: "Valery Smyslov" <[email-masked]>
Date: Mon, 3 Dec 2018 16:09:07 +0300

Hi,

I've submitted a new version of the draft-smyslov-ipsecme-ikev2-aux. Major changes:

1. The exchange is renamed from IKE_AUX to INTERMEDIATE (thanks Tommy!).
    I believe this name reflects its purpose, it's easy to pronounce and hard to mix 
     with existing exchanges.
2. The way the exchange is authenticated in IKE_AUTH is changed to include
     full transcript from both parties (thank to Scott for suggesting this).
3. The order of the chunks that are input to prf is changed, as well as the
     position of the prf outputs in the signing blobs. These changes were
     motivated by implementation experience - they make implementing
     the exchanges a bit easier. I believe they don't influence security.
4. Some clarifications are added.

Comments are more than welcome :-)

Regards,
Valery.

> A new version of I-D, draft-smyslov-ipsecme-ikev2-aux-02.txt
> has been successfully submitted by Valery Smyslov and posted to the
> IETF repository.
> 
> Name:		draft-smyslov-ipsecme-ikev2-aux
> Revision:	02
> Title:		Intermediate Exchange in the IKEv2 Protocol
> Document date:	2018-12-03
> Group:		Individual Submission
> Pages:		10
> URL:            https://www.ietf.org/internet-drafts/draft-smyslov-ipsecme-ikev2-aux-02.txt
> Status:         https://datatracker.ietf.org/doc/draft-smyslov-ipsecme-ikev2-aux/
> Htmlized:       https://tools.ietf.org/html/draft-smyslov-ipsecme-ikev2-aux-02
> Htmlized:       https://datatracker.ietf.org/doc/html/draft-smyslov-ipsecme-ikev2-aux
> Diff:           https://www.ietf.org/rfcdiff?url2=draft-smyslov-ipsecme-ikev2-aux-02
> 
> Abstract:
>    This documents defines a new exchange, called Intermediate Exchange,
>    for the Internet Key Exchange protocol Version 2 (IKEv2).  This
>    exchange can be used for transferring large amount of data in the
>    process of IKEv2 Security Association (SA) establishment.
>    Introducing Intermediate Exchange allows re-using existing IKE
>    Fragmentation mechanism, that helps to avoid IP fragmentation of
>    large IKE messages, but cannot be used in the initial IKEv2 exchange.
> 
> 
> 
> 
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org.
> 
> The IETF Secretariat

---

From: Paul Wouters <[email-masked]>
Date: Mon, 3 Dec 2018 08:48:49 -0500 (EST)

>    I believe this name reflects its purpose, it's easy to pronounce and hard to mix

It is missing the prefix IKE_ ?

In my opinion, IKE_SA_INIT / IKE_AUTH should have been named
consistenly, eg either IKE_SA_INIT / IKE_SA_AUTH or IKE_INIT / IKE_AUTH

So in that light, this would be better as IKE_INTERMEDIATE

INFORMATIONAL should have been IKE_INFORMATIONAL, and CREATE_CHILD_SA
is an abomination to act either on IKE or CHILD SA without seperating
its exchange :)

But if people insist on INTERMEDIATE, I won't complain further.
Consistency is already lost so it is time to stop painting :)

Paul

---

From: "Valery Smyslov" <[email-masked]>
Date: Mon, 3 Dec 2018 17:00:00 +0300

> It is missing the prefix IKE_ ?

As well as INFORMATIONAL and CREATE_CHILD_SA.

> consistenly, eg either IKE_SA_INIT / IKE_SA_AUTH or IKE_INIT / IKE_AUTH

I agree that it would have been better, but we have what we have now.

> So in that light, this would be better as IKE_INTERMEDIATE

It's a bit too long in my opinion :-)

> But if people insist on INTERMEDIATE, I won't complain further.

Definitely not "insist" for now, only "suggest" :-)

> Consistency is already lost so it is time to stop painting :)

Yes, that was my final thought too. 

Regards,
Valery.