Re: [IPsec] IPsec maintenance/extensions WG, summary so far

[Nicolas Williams <[e-mail]>]

On Wed, May 07, 2008 at 01:19:09PM +0300, [e-mail] wrote:

I'm willing to review:

> o  Update to IKEv2 base specification (possible starting point:
>    draft-hoffman-ikev2bis)

> o  IPsec document roadmap update (possible starting point: RFC 2411)

> o  IKEv2 session resumption / optimizing IKEv2 handshake when 
>    connecting again to same peer/cluster of peers (possible 
>    starting point: draft-sheffer-ipsec-failover)

> o  Labeled IPsec for RFC 430x IPsec

> o  IKEv1/IKEv2 co-existence and transition (please specify more
>    details if you select this one)


I think this item:

> o  GSS-API (or Kerberos) authentication for IKEv2

seems unnecessary.  Keep in mind that I once thought the opposite.  But
let's consider:

 - IPsec w/ Kerberos V -> KINK
 - IPsec w/ PSK, PKI, EAP -> IKEv2

So what existing, planned or potential GSS-API mechanisms might one want
to use with IPsec which isn't covered via KINK or IKEv2?

Now, perhaps there is dissatisfaction with KINK.  Or perhaps there's a
desire to mix Kerberos V and whatnot in one KE.  If so, let's hear it.
If not, let's drop this.


I'm willing to collaborate on this one:

> o  Guidelines for Mandating the Use of IPsec, for RFC430x IPsec
>    (possible starting point: draft-bellovin-useipsec)

Primarily because I think that applications shouldn't use IPsec without
IPsec APIs, and IPsec APIs is something that I'm collaborating on in the
BTNS WG.

Nico
-- 
_______________________________________________
IPsec mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/ipsec