Re: [IPsec] Issue #176: What to do with a proposal of NONE

[Paul Hoffman <[e-mail]>]

At 5:10 PM +0200 3/8/10, Tero Kivinen wrote:
>Paul Hoffman writes:
>> <http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/176>
>>
>> Pasi says:
>>
>> Section 3.3.6 says "If one of the proposals offered is for the
>> Diffie-Hellman group of NONE, the responder MUST ignore the
>> initiator's KE payload and omit the KE payload from the response."
>>
>> This seems wrong: it seems to say that if the initiator proposes DH group NONE, the responder must select it.
>>
>> However, negotiation of DH groups and KE payload is already well
>> described in Sections 1.2 and 1.3 (paragraphs mentioning
>> INVALID_KE_PAYLOAD), and it seems the last paragraph of 3.3.6 is
>> completely redundant. Thus, I'd propose just deleting the whole
>> paragraph.
>>
>> Paul says:
>>
>> That whole paragraph has been there since -00. Only the last
>> sentence was added in -03 almost a year ago. It was added to fix
>> <http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/6>, but I can
>> easily believe that fix was not correct. However, sections 1.2 and
>> 1.3 don't address the issue in the sentence quoted.
>
>The last sentence is the one that is misleading. All of the rest of
>the paragraph is just repeation of the text from elsewhere.
>
>The last sentence should be saying:
>
>		  If one of the proposals offered is for the
>   Diffie-Hellman group of NONE, and the responder selects that
>   Diffie-Hellman group, then it MUST ignore the initiator's KE
>   payload and omit the KE payload from the response.
>
>I.e. the MUST ignore, and omit the KE payload is only applicable if
>responder actually selects the Diffie-Hellman group NONE.

That makes good sense to me, and seems like less of a change to 4306 than the current wording. Do others agree?

--Paul Hoffman, Director
--VPN Consortium