WG Action: Rechartered IP Security Maintenance and Extensions (ipsecme)

The IP Security Maintenance and Extensions (ipsecme) WG in the Security Area
of the IETF has been rechartered. For additional information, please contact
the Area Directors or the WG Chairs.

IP Security Maintenance and Extensions (ipsecme)
-----------------------------------------------------------------------
Current status: Active WG

Chairs:
  Yoav Nir <ynir.ietf@gmail.com>
  Tero Kivinen <kivinen@iki.fi>

Assigned Area Director:
  Deb Cooley <debcooley1@gmail.com>

Security Area Directors:
  Paul Wouters <paul.wouters@aiven.io>
  Deb Cooley <debcooley1@gmail.com>

Mailing list:
  Address: ipsec@ietf.org
  To subscribe: https://www.ietf.org/mailman/listinfo/ipsec
  Archive: https://mailarchive.ietf.org/arch/browse/ipsec/

Group page: https://datatracker.ietf.org/group/ipsecme/

Charter: https://datatracker.ietf.org/doc/charter-ietf-ipsecme/

The IPsec suite of protocols includes IKEv2 (STD 79 and associated
RFCs), the IPsec security architecture (RFC 4301), AH (RFC 4302), and
ESP (RFC 4303). It also includes the now obsoleted IKEv1 (RFC 2409 and
associated RFCs).  IPsec is widely deployed in VPN gateways, VPN remote
access, and as a substrate for host-to-host, host-to-network, and
network-to-network security.

The IPsec Maintenance and Extensions Working Group continues the work
of the earlier IPsec Working Group which was concluded in 2005. Its
purpose is to maintain the IPsec standard and to facilitate discussion
of clarifications, improvements, and extensions to IPsec, mostly to
ESP and IKEv2. The working group also serves as a focus point for
other IETF Working Groups who use IPsec in their own protocols.

The current work items include:

Post-quantum Cryptography (PQC) brings new authentication and key
establishment methods. The working group will develop support for
using PQC algorithms. The solution will allow post quantum
authentication methods to be performed on their own or along with
the existing authentication methods. This work item may also
include solutions for transport issues because of larger payload and
message sizes.

The cryptographic algorithm implementation requirements and usage
guidance documents for IKEv2, ESP, and AH were updated last in
2017. The working group will update these documents. This may also
include defining how to use additional algorithms for IPsec in separate
documents (for example sha3, and PQC).

There is a need for tools that make it easier to debug IPsec configurations.
The working group will work on documents to help that. One such tool could
be the esp-ping protocol.

The ESPv3 protocol was defined in 2005 and there may be a need to make
enhancements to it. The working group will analyze the possible problems
and work on solving them. This may include updating ESP, AH, and/or Wrapped
ESP (WESP) standards, or result in a new security protocol.

Milestones:

  Mar 2025 - Submit IPsec ping draft(s) to IESG

  Jun 2025 - Submit PQC authentication support draft to IESG

  Nov 2025 - Submit updated implementation requirements draft to IESG

  Nov 2025 - Submit enhanced ESP protocol to IESG