Subject: [IPsec] Fwd: New Version Notification for draft-pwouters-ikev1-ipsec-graveyard-00.txt

From: Paul Wouters <[email-masked]>
Date: Mon, 11 Mar 2019 14:39:03 -0400 (EDT)

As we discussed on the list and in Bangkok, we were going to submit a
document to deprecrate IKEv1 and various old skool algorithms using
a [DEPRECATED] column in the IANA registry.

I wrote a first draft to do this...

Paul

---------- Forwarded message ---------
From: <[email-masked]>
Date: Mon, Mar 11, 2019 at 2:35 PM
Subject: New Version Notification for draft-pwouters-ikev1-ipsec-graveyard-00.txt
To: Paul Wouters <[email-masked]>

A new version of I-D, draft-pwouters-ikev1-ipsec-graveyard-00.txt
has been successfully submitted by Paul Wouters and posted to the
IETF repository.

Name:           draft-pwouters-ikev1-ipsec-graveyard
Revision:       00
Title:          Deprecation of IKEv1 and obsoleted algorithms
Document date:  2019-03-11
Group:          Individual Submission
Pages:          6
URL:            https://www.ietf.org/internet-drafts/draft-pwouters-ikev1-ipsec-graveyard-00.txt
Status:         https://datatracker.ietf.org/doc/draft-pwouters-ikev1-ipsec-graveyard/
Htmlized:       https://tools.ietf.org/html/draft-pwouters-ikev1-ipsec-graveyard-00
Htmlized:       https://datatracker.ietf.org/doc/html/draft-pwouters-ikev1-ipsec-graveyard

Abstract:
   This document deprecates Internet Key Exchange version 1 (IKEv1) and
   additionally deprecates a number of algorithms that are obsolete.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Tommy Pauly <[email-masked]>
Date: Tue, 12 Mar 2019 09:19:35 -0700

Thanks for writing this up! Glad to get rid of IKEv1 =)

I do have a question regarding whether the deprecations for the IKEv2 registry are appropriate for this document. RFC 8247 contains the recommendations for the which algorithms and DH groups are going away (SHOULD NOT, MUST NOT, etc), and it seems like an update to that document or similar would be more appropriate to discuss marking deprecation.

Best,
Tommy

> On Mar 11, 2019, at 11:39 AM, Paul Wouters <[email-masked]> wrote:
> 
> 
> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Wouters <[email-masked]>
Date: Wed, 13 Mar 2019 00:04:19 -0400 (EDT)

> Thanks for writing this up! Glad to get rid of IKEv1 =)

We just need PPK and Labeled IPsec as RFC and then we are go :)

> I do have a question regarding whether the deprecations for the IKEv2 registry are appropriate for this document. RFC 8247 contains the recommendations for the which algorithms and DH groups are go…

I might have misunderstood Tero, but this what we said before:

Paul: > I'm happy to write a separate diediedie document, but it would sort of
Paul: > break the cycle of our IKE and ESP/AH document updates?

Tero: Writing separate die-die-die document would be faster, and I do not
Tero: think we have yet any pending changes for the algorithms we have in
Tero: 8221 and 8247 waiting to be done.

While it should update 8221/8247 (I'll add it for the next revision), I
think Tero is right that this isn't the regular cycle of algorithm
update using bis documents. It would be a bit overkill to already
replace those two documents, especially because the "diff" would really
not be very informative, because it would only show what are currently
MAY algorithms that are not shown in 8221/8247 at all because they
didn't change. And since we are not changing anything else, we wouldn't
show anything else in the columns. So I think doing this "out of series"
is a better solution.

But I didn't instruct IANA to put [this document] in the ESP and IKEv2
reference columns for those algorithms, which we should do as well as
adding the DEPRECATED column [insert Tero sitting at a table with "An
extra column is wrong - CHANGE MY MIND"] poster.

Paul

---

From: "Hu, Jun (Nokia - US/Mountain View)" <[email-masked]>
Date: Mon, 18 Mar 2019 20:00:32 +0000

The earlier we get rid of IKEv1, the better
Just one comment, regarding "IKEv2 has now seen wide deployment and provides a full replacement for all IKEv1 functionality." , I think there is one feature IKEv2 hasn't provided equivalent yet is group key management. Of course, I don't think it is a show stopper, just there should be some clarification on this 

-----Original Message-----
From: IPsec <[email-masked]> On Behalf Of Paul Wouters
Sent: Monday, March 11, 2019 11:39 AM
To: [email-masked] WG <[email-masked]>
Subject: [IPsec] Fwd: New Version Notification for draft-pwouters-ikev1-ipsec-graveyard-00.txt

As we discussed on the list and in Bangkok, we were going to submit a document to deprecrate IKEv1 and various old skool algorithms using a [DEPRECATED] column in the IANA registry.

Paul

---------- Forwarded message ---------
From: <[email-masked]>
Date: Mon, Mar 11, 2019 at 2:35 PM
Subject: New Version Notification for draft-pwouters-ikev1-ipsec-graveyard-00.txt
To: Paul Wouters <[email-masked]>

A new version of I-D, draft-pwouters-ikev1-ipsec-graveyard-00.txt
has been successfully submitted by Paul Wouters and posted to the IETF repository.

Title:          Deprecation of IKEv1 and obsoleted algorithms Document date:  2019-03-11

Abstract:

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: "Valery Smyslov" <[email-masked]>
Date: Tue, 19 Mar 2019 11:34:07 +0300

Hi Jun,

> Just one comment, regarding "IKEv2 has now seen wide deployment and provides a full replacement for all
> IKEv1 functionality." , I think there is one feature IKEv2 hasn't provided equivalent yet is group key
> management. Of course, I don't think it is a show stopper, just there should be some clarification on this

The Group Key Management for IKEv2 is on the new ipsecme charter and 
there is even a candidate document for it: draft-yeung-g-ikev2.

Regards,
Valery.

> As we discussed on the list and in Bangkok, we were going to submit a document to deprecrate IKEv1 and
> various old skool algorithms using a [DEPRECATED] column in the IANA registry.
>