Re: [IPsec] GDOI and G-IKEv2 payloads

"Fries, Steffen" <steffen.fries@siemens.com> Mon, 05 February 2024 14:05 UTC

Return-Path: <steffen.fries@siemens.com>
X-Original-To: ipsec@ietfa.amsl.com
Delivered-To: ipsec@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 61D16C18DB8F for <ipsec@ietfa.amsl.com>; Mon, 5 Feb 2024 06:05:55 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -7.107
X-Spam-Level:
X-Spam-Status: No, score=-7.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIMWL_WL_MED=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=siemens.com
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ruOeBa3HhkLo for <ipsec@ietfa.amsl.com>; Mon, 5 Feb 2024 06:05:51 -0800 (PST)
Received: from EUR04-HE1-obe.outbound.protection.outlook.com (mail-he1eur04on2048.outbound.protection.outlook.com [40.107.7.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42BB7C18DB8E for <ipsec@ietf.org>; Mon, 5 Feb 2024 06:05:51 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=lj4KA7GTvuIYZ6/ESIZVqepCA8zik8bdGml2CqQmfsqssNH9W48aUWE9XNotCdpGjihy1CRsjRoeMrjGejDB+Tj0/+7tknZFBGP0gbtRr0BrxppFvTynyqtLth7z5sz4MYCDPOvPBTwUzUw3j+uZ/kDpCRprN4Aq7VWQfPdoEE2rg6weyCQqQZVfvIma9PmdY6xEAAhnliXn2A9nh4bMmGAwOR5hPKy4V+dSGGkTKnoir55X7bSllTy71Q5u5aCiXeQe4YRTqjLdBRJqqL1rrf0zPz/sQnbLwWRNS7Q4uV397NXsqTGtgG1mXeEiop7IcvDj+VVLnMea9aHnfE9ZLw==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=dyB63mZX9PBjwRfDVffDRehavhpmkU66i7zxJQD7HS8=; b=mr9KFvs1xZ8cizRAWnuPSwUT7vmMt0K6tykgniI78GYCDI4RmoZ853xMao33/AzGzhi26xWApK/reqDa/a0D0JI28zRHxxcRLPL0H04afmOKNVAGlKWPAJKteXRSGEx3LcVQqHT3M5gT3E57z2Y4rnU3sEbdZI3WEupTrQC8+aUkp8aEN/mNxzARQ1Hs6KJ4RoGAvs7jxms8U9qhKh3hAH3JKGEh9feLGMBDsSdWS+bKzaXIDagKBlVwdPckoNmKQ7lBPPDnazFDKgLdXXoOidlvtUV9A1DBL3Jv26SgoLFkUbVZeY9ZK4kZDCqzDE5hIQH3QJ3qa9rfW1J+vhkgJw==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=siemens.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=dyB63mZX9PBjwRfDVffDRehavhpmkU66i7zxJQD7HS8=; b=kynx+Hvdp31awBnTOh3+tbIEoRqwyjR253w9S7NnKuu5MviJ19364dQQBl45gu3HqgjpVVDCcc4g8GQcqZ1ysGHv0Y7vhKN8QZHrNGbQ9YnyF5Ut2ZJJs4WTVFTv/TZ7NOpOhHP60CB7FF7ORqfr8/xMbrzHsOM8SL5XykEWeaE8XpYR74NOeWHEsZZGkrThC8t3HmlxJPpSZbnuXASuKTXOW6Osp6EnE0TrttMxIZd1wQ7pFxICrO7GpIigUKfn/ONfxRYY5vG7RS0nd0YOiXUrlQousXDJIOoxtG3MqWYW3+0QchIoUORH/PPGQ9jUQilx+FdtDVv98RQQJ7dweQ==
Received: from DB9PR10MB6354.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:10:3c6::22) by AS4PR10MB5524.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:4ce::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7249.34; Mon, 5 Feb 2024 14:05:48 +0000
Received: from DB9PR10MB6354.EURPRD10.PROD.OUTLOOK.COM ([fe80::46f5:6c35:6d02:c724]) by DB9PR10MB6354.EURPRD10.PROD.OUTLOOK.COM ([fe80::46f5:6c35:6d02:c724%2]) with mapi id 15.20.7249.032; Mon, 5 Feb 2024 14:05:48 +0000
From: "Fries, Steffen" <steffen.fries@siemens.com>
To: Valery Smyslov <smyslov.ietf@gmail.com>, "ipsec@ietf.org" <ipsec@ietf.org>
Thread-Topic: [IPsec] GDOI and G-IKEv2 payloads
Thread-Index: AdpX5r6A7czED10vRGGJXbnBwfkIOgAIXPuAAAyvQbA=
Date: Mon, 05 Feb 2024 14:05:48 +0000
Message-ID: <DB9PR10MB63545979E313C96B00282434F3472@DB9PR10MB6354.EURPRD10.PROD.OUTLOOK.COM>
References: <DB9PR10MB6354CF46CDE84485FB1510BCF3472@DB9PR10MB6354.EURPRD10.PROD.OUTLOOK.COM> <029001da5808$33763b20$9a62b160$@gmail.com>
In-Reply-To: <029001da5808$33763b20$9a62b160$@gmail.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
msip_labels: MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_ActionId=229b6e00-cdfc-4582-a46f-a27d562d0919; MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_ContentBits=0; MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_Enabled=true; MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_Method=Standard; MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_Name=restricted; MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_SetDate=2024-02-05T13:55:10Z; MSIP_Label_9d258917-277f-42cd-a3cd-14c4e9ee58bc_SiteId=38ae3bcd-9579-4fd4-adda-b42e1495d55a;
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=siemens.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: DB9PR10MB6354:EE_|AS4PR10MB5524:EE_
x-ms-office365-filtering-correlation-id: 543d31fe-4f69-46c1-cf18-08dc26538dcb
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: /n2jIF+EdcIcP+LVFQ3tG67iBAB+QvDQuiORErDoS8zCLbMGRUQoZ6NH/aCyQSoREWohbTJ7pSf13evYBN2PaAyxjZsqn3RLr6DOK3ulup7/9aMjLX0Cci5KzRXIW+3Egwzfn2MIxyGJomd1+H1KgEPOgHLcMmsLbDqj4kjnM2ERahw50hslvRx79Cufb4DZExhWd2b9iAACsJ35t0tZdgEE+3in88gbKA3qUdTBeOR9fJYGbx3vHfsymNufJ0MpVV8SkvTw7zC2VxP8KKGmLsRA164sbBJ8uOVNJBNCGZOIWwZxaxLvZjqanrzpsuNZ2XprJAN3uIB8mc10KPVe/kFzK59fGPmE8dhXWxyGSa+eiLhr7nYuEe0hUkS6Kb8xQ/U7B4kDXt2Yj71vDXnaYvGyvP6NnHJod67jFOwRkWBM8MStdYKELbjoOOYGqaD4FPFM+7L7WTwn2CKIwOWPiVVAhLFlNJxGdvoZulxzwbGbJXf/zmilMOLeI3DVF9gX8ymKg497KwInoOfYEsHx2q61tZ0X42bdPnzoZUYeRStbRTA6Woqw/yc0yvMUMvoPkjnc/qboK63OJeEliUaKsNCTgNt3IZ6WINeJChYbTWo=
x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB9PR10MB6354.EURPRD10.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230031)(346002)(366004)(136003)(376002)(396003)(39860400002)(230922051799003)(186009)(451199024)(64100799003)(1800799012)(55016003)(33656002)(86362001)(9686003)(53546011)(478600001)(38070700009)(41300700001)(26005)(82960400001)(83380400001)(99936003)(52536014)(66476007)(5660300002)(6506007)(316002)(64756008)(7696005)(66946007)(71200400001)(66556008)(2906002)(122000001)(8676002)(8936002)(9326002)(66446008)(38100700002)(76116006)(110136005); DIR:OUT; SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: JVieFWOnWlEGwByKGGh+8J5LiPzFv9GrXG+iGmfZ/NuzpMvlFz5pD507vQPAT38Expmoc/++lt6nIFRyfzsvK1OS9fx9/+qIUj18ltIug5gE1sgy278msLQcKaf9kmSlPsTf5ZNbo8xqzPSBma1C31nSOPJKuxmDzIl+3FT+TpUGke9IWzF7AlPKN9001kh4wpDSP6SIfvxZ6ycCxHSJtTxkDoIHw2nG7wNortvO+jA+Ia2JoTtjWP7aI8gRGi/NJ7SfaXv6+DlodWjiaYOnYG5NjGPEGg5VAVTIZP3Yd0/l5/R9A2ap6dHVvaxYP3NXKABSwTC3XHazezjFl7yLKcfr3BLjvKMAhja8HVsvlLN+5g5fJlKXM//RTVJhDq5R8h+5dlcf70Ylezqqya6PfBu+yqQcEGkbsYb++LI2bQHTGqFXsp4lJ+09y6r5HA4lRnjmC+EyXsUMQGCOMRAh7CiwAu5/5WAuDp0OAka/JIupoyhfqff+dQkhnTYUpj6tFqFx/s5Rqkg9GW/yOII2yzBzJtNQb30RU9UUchEdPHHb0rhIkSDMRx4O3IArXnvKInSgH6Ya5XRw/NThxnwLXvsyHZM667xy0WlARhgvlvKHh7TzRfYKUyUJbbKa3Bb3hus2OU7gDBt/8zpn+WrkAi4NCrHnfeBKnTRvJPbwCMsiKWzwtTSu5hokyc0m5CjD5AKCjzXz+OkmrATtzuqwKJwT5Y4zHr56+Rno7ul/MP9ujsFxBybv6nbcrr5yk0eqd4J++IAvxZMk6AZp7KOqlk9JlrRyKT0HOAEo8UhANbo2lHS3r9277a8Q/VYyTTEG2uYow+sv2wqK5UtgSDuxFul2IfOANAJDn7Vt8tZjer1rxm6deY8ReS6nyMbttsMhsNJh9rSX5LkU03+zIAxKnOpcTzNhjo+QM8Lt5I/JpW2hWXxI99I3MzdgC3B+8uHcDd2+PpXvYVesrbbf8ztfyzFnhGBYsvDqeYX5axqZhV38OZVHMWFSnz9pTgWGXQdpQLXFja6eN/JxMRw/Yb2saR02P3KyNy6n6Bkh559KLPRA9vnE3HRpIUNHsc9bcN6zCOZYisEbPpiZmX8VBZHVUO7KWOs+4AwUNHoQgNPjkLZveX5q1OBfV66xFZ+4XxQAA/vCfDYfpbKUI2x/UcttQJ+5jNrycMR07lrVBk86/sA5KleNrBdvyjvmXwun2uukBhdGs1q2D8lqAV/zZuv18MrxyPAMQKRFSpHWyG3ToMridlkRdqYXA/REBLP4gXIiOQs2fZS+uqHpYTPZk2MytQW6Eall+8xm4MUr0Pi8gXmOG0uiejizMlyCEJ9WaPQdz1lWQMikIKXVzrF7RJzR2MVGxLOeWGTIxaVGbpj0eph4+LHxz8Cw2BCX667DZ8NnjwMmgzPGM9mnGVq1izTYN7zXYZYsT6APPYmwH25ogOcLb7Gq07p4FIfzHJP6ZLD9tzzY8o4269ilOQRL1sguFYhGgyBcIq6JkqNI0j+8YQtUfJKIZAirXwyS34OVvdVArDhcm8DGCOZ5Q1s/+In4yjyG2yVKPhCscluBbBQfqlN4PnnlBArSvh2aUhFYraFEiMyED98i/KCRE5xIzxOQkw==
Content-Type: multipart/related; boundary="_004_DB9PR10MB63545979E313C96B00282434F3472DB9PR10MB6354EURP_"; type="multipart/alternative"
MIME-Version: 1.0
X-OriginatorOrg: siemens.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: DB9PR10MB6354.EURPRD10.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 543d31fe-4f69-46c1-cf18-08dc26538dcb
X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Feb 2024 14:05:48.2228 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: m2Jxg3HaI4Xf+Elqqgo+UxZhqN5Av3kZSUOMvnwfFQThAQVof5mh8iKudGKwrmbZ/JQCApxtMHIfvE1LGnJSaPIt7FiCTB0cn80yzpzh1eE=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS4PR10MB5524
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipsec/JcW0QvfZIWBN3CInx9q_z-I9XsA>
Subject: Re: [IPsec] GDOI and G-IKEv2 payloads
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipsec/>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 05 Feb 2024 14:05:55 -0000

Hi Valery,

Thank you for the prompt answer. This is somehow what I have expected. Just wanted to double check. So there is at least the chance to proceed with the approach picked in RFC 8052. It still requires specification, but allows for taking the same approach. This would be important to have at least the same semantic of the payloads.

That already answers my question.

Best regards
Steffen

From: Valery Smyslov <smyslov.ietf@gmail.com>
Sent: Monday, February 5, 2024 8:52 AM
To: Fries, Steffen (T CST) <steffen.fries@siemens.com>; ipsec@ietf.org
Subject: RE: [IPsec] GDOI and G-IKEv2 payloads

Hi, Steffen,

in general, G-IKEv2 is not backward compatible with GDOI (likewise IKEv2 is not backward compatible with IKEv1).
For this reason extensions defined for G-DOI should be redefined for G-IKEv2 (once it becomes an RFC).
>From my reading of RFC 8052, it doesn't define new payloads for GDOI, instead new ID type, Protocol ID etc.
are specified. The same approach could be used for G-IKEv2 too.

Regards,
Valery.

Hi,

I've got a question regarding the relation of G-IKEv2 and GDOI.

I realized that G-IKEv2 will be the successor of GDOI and would have a question regarding backward compatibility of payloads defined for GDOI. As the underlying exchanges for the base key management changed from IKE to IKEv2 they will not be backward compatible. Nevertheless, there have been enhancements of GDOI for protocols used in the power system domain like GOOSE and Sampled Values, which lead to the definition of new payloads for the ID, SA TEK and KD payloads to accommodate the power system protocol parameters in RFC 8052. Likewise, using the same approach new payloads of the same types have been defined to distribute parameters for PTP (Precision Time Protocol) in IEC 62351-9.

In general, I realized that there are similar payloads available in G-IKEv2 but I was not quite sure, if it was a design criterion to have backward compatibility for extensions/enhancements defined for GDOI to be usable also in G-IKEv2. Could you please shed some light on this?

Best regards
Steffen

--
Steffen Fries

Siemens AG
Technology
Cybersecurity & Trust
T CST
Otto-Hahn-Ring 6
81739 Munich, Germany
Phone: +49 (89) 7805-22928
mailto:steffen.fries@siemens.com
www.siemens.com
[Logo]
Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Jim Hagemann Snabe; Managing Board: Roland Busch, Chairman, President and Chief Executive Officer; Cedrik Neike, Matthias Rebellius, Ralf P. Thomas, Judith Wiese; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin-Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322