Subject: [MSEC] <no subject>

From: Aldous Yeung <[email-masked]>
Date: Wed, 21 Apr 2010 15:01:11 -0700

Hi,

The following are the answer to the questions asked during G-IKEv2 draft
presentation:

1. Why do we define the GSA payload and not just use the IKEv2 SA payload?
Answer:
 i. There is overhead in the IKEv2 SA payload structure that we don¹t need.
In G-IKEv2, the KS does not negotiate the group policies with the GM, but
pushes the group policies to the GM.  So, the whole proposal sub-structure
is not needed.
ii. Since the mechanism of G-IKEv2 is very similar to GDOI, the format of
GSA payload is matched with the SA payload of GDOI.

2. Why do we redefine the SIG payload but not reuse AUTH payload in IKEv2
since the formats are the same?
Answer:
Good point, I am going to incorporate it in the next draft update, here will
be the changes:
i. Section 4.11 will be replaced with description of the use of AUTH
payload, instead of creating the new one.
ii. Section 4.4.6, the name of the SIG_HASH_ALGORITHM will be changed to
AUTH_HASH_ALGORITHM.
iii. Section 4.4.7 to 4.4.8 will be removed as these will be covered by the
IKEv2 registry.
iv. All the references to the SIG payload will be replaced by AUTH payload.

Feel free to let us know for more questions or feedback on the draft.

Thanks,
Aldous