IETF Logo Mail Archive

[IPsec] Re: [EXT] Re: draft-smyslov-ipsecme-ikev2-downgrade-prevention

Christopher Patton <cpatton@cloudflare.com> Thu, 31 July 2025 13:08 UTC

Return-Path: <cpatton@cloudflare.com>
X-Original-To: ipsec@mail2.ietf.org
Delivered-To: ipsec@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 5FF9F4DCE9C0 for <ipsec@mail2.ietf.org>; Thu, 31 Jul 2025 06:08:17 -0700 (PDT)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.098
X-Spam-Level:
X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=cloudflare.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WMZRUaAhpkWE for <ipsec@mail2.ietf.org>; Thu, 31 Jul 2025 06:08:16 -0700 (PDT)
Received: from mail-qt1-x831.google.com (mail-qt1-x831.google.com [IPv6:2607:f8b0:4864:20::831]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 8D5F84DCE98B for <ipsec@ietf.org>; Thu, 31 Jul 2025 06:08:09 -0700 (PDT)
Received: by mail-qt1-x831.google.com with SMTP id d75a77b69052e-4ab82eb3417so9363461cf.2 for <ipsec@ietf.org>; Thu, 31 Jul 2025 06:08:09 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cloudflare.com; s=google09082023; t=1753967289; x=1754572089; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=HQ5jhayE3IX+CzZN2fheX5AQ4Wkj1xyYYpHaB4fio8U=; b=eZNqo0XT2jJE3LBNHabswFsCeCkC6HJaf2j40n/+LcWNjKU7bZWR4sVUulHP36q2K1 wh2tVykLAPrS2djsaeAgFGUv2rnrfeFUWk+LSKgEhIBh1P3nlNNZxszk/JQ0xytw+Kpl MMXK+4O4Tb547MhBlSQXD+JtGBfoP4UwZ8nNQYowM3EeaqJT9egtr3kppm6lzJr7P/f4 wmnJibYMr/5l7p4YRspoZNWi00IxEl66QZiUXtDBw69tqeDA14CnPXFkbFcWsObhhCpy hwQC97DWHLWNDo4Wtkx9SUoRsM+dfNH9m22nW7AzcbA2tZ8sO7Rhifrbi844kM4P4k9K LwSQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1753967289; x=1754572089; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=HQ5jhayE3IX+CzZN2fheX5AQ4Wkj1xyYYpHaB4fio8U=; b=dqKWzg3ViJ9YgsldWu6jGL2s8R6bw4B2I5CJt6TZ/DzmvsyzjtuHKqxj6J0TX2sRtG aC/E368+NKpkSrBHrTSItog5a0fatc9JbPNwAGd4dX+os8iOweR4O1Tz1A71S5kSDqEv TESjg7J3Ojqhs+cYhsbfdew5Cp5BKBO8fsX3/4nvt8gelLXdnJ52rmN9pBh3HYyoaVxw HiuDZXiWAZVuSuIJds3WUMfTzbMeN2zJDIu9e3uA4ktadA1oEJ53H+/Aj3JHRKAf7SYb gaXKvR6zcq15rMzcDfuv7+k4dmfShlRq+e0/AjTL4PJWx0v9YCkbTjcpDJgujKdO9qfl jsDw==
X-Forwarded-Encrypted: i=1; AJvYcCW44IoO6kKKkPQd3SM2HNoW0p7KHpvZVxKIYY4auF/QOk2qUMYLfW0SUH6QNfBocm3MLPjd1A==@ietf.org
X-Gm-Message-State: AOJu0Yza8yOd7OOD5FW6yZ459UZkJ16UiF8t5EsLgkYPi0YsqWEx65Lc k2wYPu9w2XeJbkAKNUyRJXDvtaoc8sfIv8RMMn0z3aSlem8sZthj9CDgWZSLVsNbABPnIWkuNOX Hykdj/FIH/HAjNLq/T+LM/DVkOfcn8659Xdhg2XydPA==
X-Gm-Gg: ASbGncuNgjLY3D7fzIojov+vWF69D3T9rVj3nExxug7sOW+h89UmYOIjh09y+FjFrFr 7++puBArNmFiYChau2c19yawAjScQpq5uWoEyDH7MgffTE73BQbqURD34CAOmVfMjycYcqbaICm NjLRO1efrWt+cHnCpnvbWl/fsK2F0hHx/0pUZyxGXMoUxW8qJj8MdlLi9PqLPFoV89Od3DU+evv R2oessolJfp8fbxzAkpL4wmZkGhBpNbKko7
X-Google-Smtp-Source: AGHT+IE09NRkVYnRjRgwtLn+KEDyTiSPjlL2jr8IYr+y4rE3vQIXJ/Wd6TTO2gKhIYXKBDctT3pElIvaNz50K6eM14Y=
X-Received: by 2002:ac8:5a08:0:b0:4aa:827c:1347 with SMTP id d75a77b69052e-4aedbc6d40amr116409191cf.46.1753967288460; Thu, 31 Jul 2025 06:08:08 -0700 (PDT)
MIME-Version: 1.0
References: <CAG2Zi22kbWBDq1CejN93a89OO2-VgZJ7P7bvzW_xayoDPT_dWw@mail.gmail.com> <D835D903-C901-472B-B56E-FAA2DD6B898C@ll.mit.edu>
In-Reply-To: <D835D903-C901-472B-B56E-FAA2DD6B898C@ll.mit.edu>
From: Christopher Patton <cpatton@cloudflare.com>
Date: Thu, 31 Jul 2025 09:07:57 -0400
X-Gm-Features: Ac12FXwu7gJKko927ftZ9BZdPhZYOgdfbmCi6YYhNCUV8S4l0-bkwaNztiMoLNQ
Message-ID: <CAG2Zi20be_=xAJcsZ=LtfFGui_J+p-_ea300BgjsftS-J20Q=w@mail.gmail.com>
To: "Blumenthal, Uri - 0553 - MITLL" <uri@ll.mit.edu>
Content-Type: multipart/alternative; boundary="0000000000002d536d063b3955b2"
Message-ID-Hash: WWXAVNCDXRPVW3U66LKMRCEVR2AHAG4O
X-Message-ID-Hash: WWXAVNCDXRPVW3U66LKMRCEVR2AHAG4O
X-MailFrom: cpatton@cloudflare.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-ipsec.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Jun Hu <jun.hu@nokia.com>, Michael Richardson <mcr+ietf@sandelman.ca>, Valery Smyslov <smyslov.ietf@gmail.com>, Scott Fluhrer <sfluhrer@cisco.com>, ipsec <ipsec@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [IPsec] Re: [EXT] Re: draft-smyslov-ipsecme-ikev2-downgrade-prevention
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipsec/7SJIUgJuOvGcKimdEkJaD-qDWu0>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipsec>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Owner: <mailto:ipsec-owner@ietf.org>
List-Post: <mailto:ipsec@ietf.org>
List-Subscribe: <mailto:ipsec-join@ietf.org>
List-Unsubscribe: <mailto:ipsec-leave@ietf.org>

Hi Uri and Jun,

I agree - mandating use of PPK may not work. However, suggesting use of
> PPK, i.e., as a (negotiable?) option would be a very good thing: those who
> have the ability to employ it, and want better security - would opt in.
> While those who don’t care or for various reasons cannot manage the
> distribution - could opt out.
>

This sounds like a good idea to me!
https://github.com/smyslov/ikev2-downgrade-prevention/issues/5

Chris P.

v2.46.0 | Report a Bug | By Email | System Status