[IPsec] Is IKEv2 mandatory to implement?

[Thomas Narten <[e-mail]>]

I'm looking at revising RFC 4294 (IPv6 Node Requirements), to update
its security section. (e.g., see draft-ietf-6man-node-req-bis-04.txt)

RFC 4294 (based on what I understand and recall the thinking to be at
the time) mandated IPsec (ESP/AH), but only made IKEv2 a SHOULD.

But, it's been pointed out to me that RFC 4301 actually says:

>    10.  Conformance Requirements
> 
>    All IPv4 IPsec implementations MUST comply with all requirements of
>    this document.  All IPv6 implementations MUST comply with all
>    requirements of this document.


And earlier:

>    Because most of the security services provided by IPsec require the
>    use of cryptographic keys, IPsec relies on a separate set of
>    mechanisms for putting these keys in place.  This document requires
>    support for both manual and automated distribution of keys.  It
>    specifies a specific public-key based approach (IKEv2 [Kau05]) for
>    automated key management, but other automated key distribution
>    techniques MAY be used.

This implies IKEv2 is a MUST, but doesn't quite say it. This text is
taken from Section 3, "System Overview", rather than elsewhere, where
it might be considered less normative.

Is there more specific wording in 4301 on this point? Is it viewed as
an absolute MUST requirement to implement IKEv2 in order to claim
compliance with RFC4301?

Thomas