Re: [IPsec] I-D Action: draft-ietf-ipsecme-g-ikev2-11.txt

Valery Smyslov <> Mon, 26 February 2024 13:50 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id D3853C14F749; Mon, 26 Feb 2024 05:50:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.106
X-Spam-Status: No, score=-2.106 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id ZDapXi0O2nwD; Mon, 26 Feb 2024 05:50:57 -0800 (PST)
Received: from ( [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by (Postfix) with ESMTPS id 44B24C14F747; Mon, 26 Feb 2024 05:50:54 -0800 (PST)
Received: by with SMTP id 2adb3069b0e04-512f54c81d2so1568928e87.2; Mon, 26 Feb 2024 05:50:54 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20230601; t=1708955452; x=1709560252;; h=thread-index:content-language:content-transfer-encoding :mime-version:message-id:date:subject:in-reply-to:references:cc:to :from:from:to:cc:subject:date:message-id:reply-to; bh=lbpY9ZWCXWXnip/DyLfmo+sw7/BmuaMIonFQH3WpO7E=; b=VqUGSyg56D/JsCYtdgpPPlbHKnXNkr5OiFkQbbkkQh7VYkk4RjGDMst5VNgnMlG2oa JOKS2X6mKOQnzPFDY+03h/U61P8an71myISbBv0l8Ru+smJOblSrlIAbJDmPZY2+In6z 1juZQ3BGPE2kTlXm8T46Qz93zMhqBKIuQXPn6+pk3uB/vFzznf7QAjkpRaa2UNSAD2ng e16gHM6d37595xkTaHWJIdea9dUS6yOVGUb04kLav1/cxS8bScR+BqG+5wwTKe71hZh7 +FIWB8lmg1pmeZZy6bM9gE6MhSix1pz9nkORzAzghcwlKmFNZSWMpHxj7d2nYrqp9SPr UWjA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20230601; t=1708955452; x=1709560252; h=thread-index:content-language:content-transfer-encoding :mime-version:message-id:date:subject:in-reply-to:references:cc:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=lbpY9ZWCXWXnip/DyLfmo+sw7/BmuaMIonFQH3WpO7E=; b=CmYf5Y4a0v/ep9D8bnzXV94rb0kmStCh+y+PUZ4d5Y+vey1r/qSzwEn0S4JTUYQqdX RrdKhDYn+jemTi7TtGWHr7Vh/XNEe8ZLeZj5S2vGrRTvpkcDbYT+tC/yYRPc/VLyyPuX 10TLr1g87ZsNlgGmmXJe84UEIA4tOEHjnRARjlxLQlC6WAmrFdicQ5iXa1EDLZw2ffE5 2+FYW454qR86lPyXvGyHFj1CWtGMVkoig8OgN0ucMZZsbJXIlOSCPt3bT42SNu6RmPKu 6bruO0uPDJ3DqVRu51hL0mBqdTW+9Dy8MtJVyT2mrB6/JQ/O3P4RNs3uwPygpEnyDEoD 1C5w==
X-Gm-Message-State: AOJu0Ywi6ApzQE7auRtu0qUDRPi1AVjUSCm9cqlIsgqa8+c+vUwrx3E8 LJnD+nBVr1+vL5YMHzcByyuF5zsav2efxXUUnxV31Cq8PEhP7+Pe5Kx/tkCfjUg=
X-Google-Smtp-Source: AGHT+IH8nKZZOuDZXPNGLit4R+b6QfA9rDVIZ/zCinaP3IeQMYtREHNBeOoJpSZl8vMvgoXDfzXo2Q==
X-Received: by 2002:ac2:4195:0:b0:512:99a3:62eb with SMTP id z21-20020ac24195000000b0051299a362ebmr4116839lfh.54.1708955451835; Mon, 26 Feb 2024 05:50:51 -0800 (PST)
Received: from BuildPC ([]) by with ESMTPSA id a3-20020a056512374300b00512fb973e21sm494970lfs.294.2024. (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 26 Feb 2024 05:50:51 -0800 (PST)
From: Valery Smyslov <>
References: <>
In-Reply-To: <>
Date: Mon, 26 Feb 2024 16:50:50 +0300
Message-ID: <04e201da68ba$cf6db450$6e491cf0$>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Outlook 16.0
Content-Language: ru
Thread-Index: AQJyYbi8+o8DUvQQVgGEDKjR1rQoUK/srQ4A
Archived-At: <>
Subject: Re: [IPsec] I-D Action: draft-ietf-ipsecme-g-ikev2-11.txt
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Discussion of IPsec protocols <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 26 Feb 2024 13:50:57 -0000


the -11 version of the draft addresses comments from Daniel's last review
(see my other message).
It also makes changes to the way keys are wrapped - it adds explicit
indication of key wrap algorithm (via new transform attribute), and thus
changes the key wrap format.
The changes are based on this discussion:

The draft also has a lot of fixes and clarifications. Hope it is now clearer
and is ready for forwarding.

Please review the changes.

Valery (and Brian).

> Internet-Draft draft-ietf-ipsecme-g-ikev2-11.txt is now available. It is a
work item of
> the IP Security Maintenance and Extensions (IPSECME) WG of the IETF.
>    Title:   Group Key Management using IKEv2
>    Authors: Valery Smyslov
>             Brian Weis
>    Name:    draft-ietf-ipsecme-g-ikev2-11.txt
>    Pages:   74
>    Dates:   2024-02-26
> Abstract:
>    This document presents an extension to the Internet Key Exchange
>    version 2 (IKEv2) protocol for the purpose of a group key management.
>    The protocol is in conformance with the Multicast Security (MSEC) key
>    management architecture, which contains two components: member
>    registration and group rekeying.  Both components are required for a
>    GCKS (Group Controller/Key Server) to provide authorized Group
>    Members (GMs) with IPsec group security associations.  The group
>    members then exchange IP multicast or other group traffic as IPsec
>    packets.
>    This document obsoletes RFC 6407.  This documents also updates RFC
>    7296 by renaming a transform type 5 from "Extended Sequence Numbers
>    (ESN)" to the "Replay Protection (RP)" and by renaming IKEv2
>    authentication method 0 from "Reserved" to "NONE".
> The IETF datatracker status page for this Internet-Draft is:
> There is also an HTMLized version available at:
> A diff from the previous version is available at:
> Internet-Drafts are also available by rsync at:
> _______________________________________________
> IPsec mailing list