Re: [IPsec] IPsec maintenance/extensions WG, summary so far

[Lakshminath Dondeti <[e-mail]>]

I will probably review the NAT related stuff as well, and in general 
might review most of the documents chartered anyway.  Will contribute at 
least to the failover related stuff.  At some point I was interested in 
the "use-IPsec" type of work, but I am not so sure it is really useful. 
  The work on documenting differences in IPsec usage says something 
about this already.  :)

regards,
Lakshminath

On 5/7/2008 3:19 AM, [e-mail] wrote:

> List follows:
> 

[R]  Update to IKEv2 base specification (possible starting point:
     draft-hoffman-ikev2bis)
> 
[R]  IPsec document roadmap update (possible starting point: RFC 2411)
> 
[R]  Using AEAD algorithms in IKEv2 (possible starting point:
     draft-black-ipsec-ikev2-aead-modes)
> 
[R]  Redirecting a VPN client from one gateway to another
    (in a cluster of gateways)
> 
> o  IPsec "secure beacon", or detecting whether you need VPN or 
>    not (possible starting point: draft-sheffer-ipsec-secure-beacon)
> 
> o  Detecting crashed peers faster (possible starting point:
>    draft-nir-ike-qcd)
> 
[ECR]  IKEv2 session resumption / optimizing IKEv2 handshake when
    connecting again to same peer/cluster of peers (possible
    starting point: draft-sheffer-ipsec-failover)
> 
[R]  Authentication-only IPsec that simplifies packet inspection
>    (possible starting points: draft-hoffman-esp-null-protocol,
>    draft-grewal-ipsec-traffic-visibility)
> 
> o  Better IPv6 configuration payloads (possible starting point:
>    draft-eronen-ipsec-ikev2-ipv6-config)
> 
> o  Other work for making sure IKEv1 and IKEv2 work as well as 
>    possible with IPv6, both from standards and operations standpoint
>    (please specify more details if you select this one)
> 
> o  Running IPsec over TCP (so your VPN works even if the coffee
>    shop Wi-Fi has stupid packet filtering)
> 
> o  GSS-API (or Kerberos) authentication for IKEv2
> 
> o  Non-EAP-based one-time password authentication (possible 
>    starting point: draft-sunabhi-otp-ikev2)
> 
> o  Using GRE "key" header field as IPsec traffic selector (possible 
>    starting point: draft-ma-softwire-ipsec-gre-demultiplexing-ps)
> 
> o  Authentication with Cryptographically Generated Addresses (CGA)
>    (possible starting point: draft-laganier-ike-ipv6-cga)
> 
> o  Guidelines for Mandating the Use of IPsec, for RFC430x IPsec
>    (possible starting point: draft-bellovin-useipsec)
> 
> o  Labeled IPsec for RFC 430x IPsec
> 
> o  IKEv1/IKEv2 co-existence and transition (please specify more
>    details if you select this one)
> 
> o  Setting up GRE tunnels with IKE (possible starting point:
>    draft-wu-l3vpn-ipsec-gre-00)
> 
> o  Connecting IKEv2 peers behind NATs via a "mediation server"
>    (possible starting point: draft-brunner-ikev2-mediation)
> 
> o  Anything that may be needed from IKE/IPsec with respect to 
>    routing protocol security (please specify more details if
>    you select this one)
> 
[CR]  Documenting differences in IPsec usage in IETF vs. 3GPP vs.
    3GPP2 vs. WiMAX vs. vendors etc. (please specify more details
>    if you select this one)
>   
> o  IKEv2 CAPTCHA
>    (possible starting point: draft-mutaf-spikev2-01.txt)
> 
> Please reply (on the mailing list) within a week or so -- I will 
> then summarize what we have.
> 
> Best regards,
> Pasi
> 
> ---
> 
> P.S. It's good to note that we currently have several other WGs
> working on IPsec:
> 
> o  BMWG: benchmarking IPsec devices
> 
> o  BTNS: unauthenticated or leap-of-faith IPsec, channel bindings,
>    IPsec APIs for applications (not key management daemons like 
>    PF_KEY)
> 
> o  MEXT: interaction between IPsec and Mobile IP, Mobile IP 
>    specific extensions to IPsec
> 
> o  MSEC: multicast IPsec
> 
> o  ROHC: header compression in IPsec tunnel mode SAs
> 
> o  SOFTWIRE: IPsec tunnels as a softwire, setting those up 
>    based on BGP etc.
> 
> These WGs will continue as-is, and e.g. any changes to their charters
> are not in the scope of this discussion. Future work items could be
> considered case-by-case, but the intent is *not* to collect all
> IPsec-related work to one WG.
> 
> ---
> 
> P.P.S. Acknowledgement: if you followed how Julien Laganier and
> Marcelo Bagnulo handled the MEXT WG rechartering recently, you'll
> notice I have stolen some ideas from them :-)
> _______________________________________________
> IPsec mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/ipsec
> 
_______________________________________________
IPsec mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/ipsec