Re: [Hipsec] WGLC: draft-ietf-hip-rfc5202-bis

[Gonzalo Camarillo <[e-mail]>]

Folks,

note that we are waiting for this issue to be resolved in order to
request the publication of RFC4843bis, 5201bis, and 5202bis.

Thanks,

Gonzalo

On 14/06/2013 9:57 AM, Petri Jokela wrote:
> 
> On 11.3.2013, at 23.57, Henderson, Thomas R wrote:
> 
>> This is a WGLC review of RFC5202-bis.
>>
>> This draft seems to be close to being ready.  There are two areas (more detail below) that IMO could be clarified or else left out of scope:
>>
>> 1) handling of simultaneous IPsec and HIP ESP
> 
> 
> Hi, 
> 
> I somehow missed this point when I was fixing the document. I'm not sure what we should do with this, any comments or suggestions? Currently the document says:
> 
> 3.4.  IPsec and HIP ESP Implementation Considerations
> 
>    When HIP is run on a node where a standards compliant IPsec is used,
>    some issues have to be considered.
> 
>    The HIP implementation must be able to co-exist with other IPsec
>    keying protocols.  When the HIP implementation selects the SPI value,
>    it may lead to a collision if not implemented properly.  To avoid the
>    possibility for a collision, the HIP implementation MUST ensure that
>    the SPI values used for HIP SAs are not used for IPsec or other SAs,
>    and vice versa.
> 
>    In the sending host, the HIP SA processing takes place always before
>    the IPsec processing.  Vice versa, at the receiving host, the IPsec
>    processing is done first for incoming packets and the decrypted
>    packet is further given to the HIP processing.
> 
>    Incoming packets using an SA that is not negotiated by HIP MUST NOT
>    be processed as described in Section 3.2, paragraph 2.  The SPI will
>    identify the correct SA for packet decryption and MUST be used to
>    identify that the packet has an upper-layer checksum that is
>    calculated as specified in [I-D.ietf-hip-rfc5201-bis].
> 
> 
> /petri
> 
> _______________________________________________
> Hipsec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/hipsec
> 
>