Subject: [IPsec] ikev1-graveyard

From: Michael Richardson <[email-masked]>
Date: Sun, 07 Apr 2019 14:11:13 -0400

I have read draft-pwouters-ikev1-ipsec-graveyard-00.

I think that the actual words and organization of the document could use a
bit of polish, but fundamentally it does the right thing, and sends the right message.

I would like to ask the WG to adopt this document, we can sort out the
wording afterwards, and spend (priority) WG time on this document.

I would very much like to point to a clear statement when I see IKEv1 being
used in the field for no good reason (except that nobody thought about IKEv2).
If it has to be in the form of an RFC, so be it: I'd like to be able to say
to a manager, "You are not RFCZZYY compliant", and I'd like this to get
into a variety of security audit lists.

The document likely has likely little technical impact, and I think we should
acknowledge that this is a policy statement.
That's okay with me, if it it is okay with the IESG.
If there is another way to get the same impact, I'm open to hearing it.

The datatracker page for RFC2409 already says:
   Type		RFC - Proposed Standard (November 1998; No errata)
   Obsoleted by RFC 4306
   Updated by RFC 4109

But, I think that the goal is to mark these documents as Historic as well.
I didn't see that action in the document specifically (maybe I missed it).
Many updates to the IANA registries, which we could do in other ways, I think.

As I understand it, marking something as Historic is something the IESG can
do without publishing a document.  The changes to the IANA registries I'm
less clear about, but I believe it could also be done without a document.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 8 Apr 2019 15:54:29 -0500

> less clear about, but I believe it could also be done without a document.

To move to historic, there should be some form of document (per
https://www.ietf.org/blog/iesg-statement-designating-rfcs-historic/) but it
need not be published as an RFC.  The past few times we've done this
everyone involved had to think for a while to remember what the right way
to wrangle the wording in the published RFC should be, but we can worry
about that later if we need to.

-Ben

---

From: Paul Wouters <[email-masked]>
Date: Mon, 8 Apr 2019 17:03:13 -0400 (EDT)

> about that later if we need to.

Historic really means "no longer used", which we all hope would be the
case for IKEv1, but sadly is not. Seeing how a billion android devices
only support IKEv1, I think "historic" is really not the correct action
at this point.

Paul

---

From: Michael Richardson <[email-masked]>
Date: Mon, 08 Apr 2019 18:30:32 -0400

> only support IKEv1, I think "historic" is really not the correct action

I don't think that the IETF has any other levers.
Marking it as historic does mess up procurement mechanisms, if they actually
pay attention to that.

I know that the Google Android team are aware of the lack, but it seems
that it is not a priority.  This is sad, but the IETF works with carrots, not
sticks.

But, to be clear: I'd like the WG to adopt your document, and I'd like it to
be the basis for *something*.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     [email-masked]  http://www.sandelman.ca/        |   ruby on rails    [