Subject: [IPsec] I-D Action: draft-ietf-ipsecme-g-ikev2-06.txt

From: [email-masked]
Date: Wed, 06 Apr 2022 05:27:51 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IP Security Maintenance and Extensions WG of the IETF.

        Title           : Group Key Management using IKEv2
        Authors         : Valery Smyslov
                          Brian Weis
	Filename        : draft-ietf-ipsecme-g-ikev2-06.txt
	Pages           : 68
	Date            : 2022-04-06

Abstract:
   This document presents an extension to the Internet Key Exchange
   version 2 (IKEv2) protocol for the purpose of a group key management.
   The protocol is in conformance with the Multicast Security (MSEC) key
   management architecture, which contains two components: member
   registration and group rekeying.  Both components require a Group
   Controller/Key Server to download IPsec group security associations
   to authorized members of a group.  The group members then exchange IP
   multicast or other group traffic as IPsec packets.  This document
   obsoletes RFC 6407.  This documents also updates RFC 7296 by renaming
   one of transform types defined there.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-g-ikev2/

There is also an htmlized version available at:
https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-g-ikev2-06

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-ipsecme-g-ikev2-06

Internet-Drafts are also available by rsync at rsync.ietf.org::internet-drafts

---

From: "Valery Smyslov" <[email-masked]>
Date: Wed, 6 Apr 2022 15:44:07 +0300

Hi,

this version addresses discussion we had at IETF 113. In particular:

1. Explicit PSK authentication is removed.
2. USE_TRANSPORT_MODE notification is used as in IKEv2
     (which implies a restriction that all IPsec SAs in GSA must use the same mode).
3. Using ESN is MUST NOT now, but it is MUST for GCKS to rekey frequently enough to prevent SN overlap.
4. Using replay protection is clarified. This is probably the most important change,
    since the semantics of "Extended Sequence Numbers" transform is enhanced,
    which leads to its renaming to "Replay Protection" transform and thus
    we formally update RFC 7296 (although only by renaming IANA registry).
    See new section 2.6.
5. UDP encapsulation of ESP is prohibited for multicast Data-Security SAs.
6. Default Activation Time Delay and Deactivation Time Delay are set to 0 (no delay,
     wasn't specified before).
7. Using tunnel and transport mode clarified.
8. Clarified, that using port 848 in the IKE_SA_INIT exchange doesn't change
    behavior comparing to port 500 (in particular, in both cases switch to 4500 in case of NAT).
9. Multiple text improvements.

Please, review.

Regards,
Valery.

> _______________________________________________
> IPsec mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipsec