Subject: Re: [IPsec] graveyard: deprecate->historic

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 1 Jan 2020 14:01:12 -0800

On Mon, Dec 30, 2019 at 09:41:11PM -0500, Paul Wouters wrote:
> On Mon, 23 Dec 2019, Benjamin Kaduk wrote:
> 
> > "this document" (i.e., the RFC-to-be) does not actually effecuate the move
> > to Historic status; the separate "status-change" document does so.  Looking
> > at a recent example in RFC 8429, we see this phrased akin to "Accordingly,
> > IKEv1 has been moved to Historic status" with no claim of doing so because
> > of the current document.
> 
> Changed, see https://tools.ietf.org/rfcdiff?url2=draft-pwouters-ikev1-ipsec-graveyard-04.txt
> 
> Paul
> 
> >>  requests IANA to close all IKEv1 registries.
> >> 
> >> 2: Change section title
> >> 
> >> s/Deprecating IKEv1/RFC 2409 to Historic
> >
> > This is probably okay to keep (I see Paul took the changes already), but
> > the first sentence is still "IKEv1 is deprecated", which is sending mixed
> > signals.
> 
> Is it a mixed signal? I've left the sentence in for now, but I'm fine if
> we decide to remove it. I can always do that after adoption when I need
> to re-submit the draft under the new name anyway.

I guess it's not entirely clear.
https://ietf.org/about/groups/iesg/statements/designating-rfcs-historic-2014-07-20/
implies that "Historic" is for technology that is "retired", but in some
usage, "deprecated" has more of a connotation of "not the best choice right
now" which is not necessarily fully "retired".

We can leave it as-is for now.

-Ben

---

From: Sean Turner <[email-masked]>
Date: Wed, 8 Jan 2020 11:29:25 -0500

> On Jan 1, 2020, at 17:01, Benjamin Kaduk <[email-masked]> wrote:
> 

BTW - however this ends up, I hope the WG will adopt this draft.

spt

---

From: Dan Harkins <[email-masked]>
Date: Fri, 10 Jan 2020 00:01:39 -0800

On 12/23/19 10:46 AM, Benjamin Kaduk wrote:
> Since we're in pedantic process mode...
[snip]
> Perhaps something like "IKEv1 is no longer relevant for Internet
> systems" would work, though I suspect we could even get away without such
> an intro sentence and just dive in straight with "Systems running IKEv1
> should be upgraded and reconfigured to run IKEv2.

   See that's the thing. There is nothing compelling to force the change 
away
from "no longer relevant" so people still use it. If there was something
compelling to make people want to change we wouldn't be forced to do this,
sigh, die die die nonsense. Perhaps, "we're the IETF and we are really
serious now". That should dispel all doubt in whoever happens to read this
RFC. That way we won't need a die die die die or a die die die die die die.

   Dan.

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 12 Jan 2020 22:35:41 -0800

> RFC. That way we won't need a die die die die or a die die die die die die.

I'm only aboue 95% sure I'm parsing you properly -- you're saying that if
there was a clear reason to move from IKEv1 to IKEv2 the market would have
done it already and we wouldn't be bothering with a doc like this?  That
is, that what we're really doing is akin to "we're the IETF and we
pinky-swear that we're not going to touch this anymore" as opposed to "here
is a list of the ways that using IKEv1 is going to bite you"?

Thanks,

Ben

---

From: Dan Harkins <[email-masked]>
Date: Mon, 13 Jan 2020 07:36:38 -0800

> is a list of the ways that using IKEv1 is going to bite you"?

   Yes, that's what I'm saying. From discussing this over the past few 
meetings
it seems the motivation for this is because people are still getting 
pressure
in their companies to work on IKEv1 or support IKEv1 or whatever and 
people want
it to go away. But they're losing that argument at work so they want a 
document
with the imprimatur of the IETF that they can wave at the PLM person (or 
whoever)
and say, "SEE! IT'S DEAD! Finished. No more. Over. The IETF has spoken!"

   So my "we're the IETF and we're serious this time" was sarcastic (and 
that comes
out poorly in email, hence the parsing difficulty) because I don't think 
this is
what the RFC process is for.

   IKEv1 is done, it's over, it's dead. It's been like that for more 
than a decade.
We already made a statement that we won't touch IKEv1 anymore and we 
made that
statement fifteen years ago. And we're still doing "die die die" stuff 
that's now
been refashioned into a "graveyard" effort in order to address the sensitive
sensibilities of the new IETF, but it's still the same thing. It's 
trying add an
underscore and an exclamation point to a statement that was already 
made. Because
we're really serious this time-- it's in the graveyard!

   Dan.

---

From: Paul Wouters <[email-masked]>
Date: Mon, 13 Jan 2020 11:55:47 -0500 (EST)

On Mon, 13 Jan 2020, Dan Harkins wrote:

> IKEv1 is done, it's over, it's dead. It's been like that for more than a 
> decade.

I think there is a big difference between "done developing it" and "done
running it". A decade ago almost everything was IKEv1. Today, with the
exception of Android and ten year old gear, everything is IKEv2. And
Android is scheduled to fix that this summer. So the move to Historic
does seem valid now, and was not 10 years ago.

> We already made a statement that we won't touch IKEv1 anymore and we made that
> statement fifteen years ago. And we're still doing "die die die" stuff that's now
> sensibilities of the new IETF, but it's still the same thing. It's trying add an
> underscore and an exclamation point to a statement that was already made.  Because

I agree, it is kind of a symbolic gesture. But I think it will help
(and not harm), so I think we should just publish it for those who can
use it as a lever to migrate more older setups to new. To be honest,
the biggest gain will be that people stop using DH1024, DH1536 and SHA1
that are defacto the only DH groups used with IKEv1.

Paul

---

From: Michael Richardson <[email-masked]>
Date: Mon, 13 Jan 2020 13:53:56 -0500

Paul Wouters <[email-masked]> wrote:
    >> IKEv1 is done, it's over, it's dead. It's been like that for more than
    >> a decade.

    > I think there is a big difference between "done developing it" and
    > "done running it". A decade ago almost everything was IKEv1. Today,
    > with the exception of Android and ten year old gear, everything is
    > IKEv2. And Android is scheduled to fix that this summer. So the move to
    > Historic does seem valid now, and was not 10 years ago.

+1

    >> made that statement fifteen years ago. And we're still doing "die die
    >> die" stuff that's now been refashioned into a "graveyard" effort in
    >> order to address the sensitive sensibilities of the new IETF, but it's
    >> still the same thing. It's trying add an underscore and an exclamation
    >> point to a statement that was already made.  Because we're really
    >> serious this time-- it's in the graveyard!

    > that are defacto the only DH groups used with IKEv1.

It will gain more than symbolism if it becomes an audit checkpoint, and will
actually push people to upgrade.

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-