Re: [IPsec] Éric Vyncke's No Objection on draft-ietf-ipsecme-ikev2-intermediate-09: (with COMMENT)

[Valery Smyslov <[e-mail]>]

Hi Éric,

thank you for your comments.

> Éric Vyncke has entered the following ballot position for
> draft-ietf-ipsecme-ikev2-intermediate-09: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/
> for more information about how to handle DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ikev2-intermediate/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thank you for the work put into this document.
> 
> Please find below some non-blocking COMMENT points (but replies would be
> appreciated even if only for my own education).
> 
> Special thanks to Yoav Nir for the shepherd's write-up including the section
> about the WG consensus.
> 
> I hope that this helps to improve the document,
> 
> Regards,
> 
> -éric
> 
> ## Abstract
> 
> The abstract would benefit by adding a few use cases / applicability statement
> (per the shepherd's write-up and introduction, i.e., a hint for PQ crypto).

I updated the abstract as follows:

   This document defines a new exchange, called Intermediate Exchange,
   for the Internet Key Exchange protocol Version 2 (IKEv2).  This
   exchange can be used for transferring large amounts of data in the
   process of IKEv2 Security Association (SA) establishment.  An example
   of the need to do this is using Quantum Computer resistant key
   exchange methods for IKE SA establishment.  Introducing the
   Intermediate Exchange allows re-using the existing IKE fragmentation
   mechanism, that helps to avoid IP fragmentation of large IKE
   messages, but cannot be used in the initial IKEv2 exchange.

Is it OK?

> ## Section 1
> 
> s/If size of a message is large enough, IP fragmentation takes place/If size of
> a message is larger than the MTU, IP fragmentation takes place/

I have no problem with this clarification, but I suggest s/MTU/PMTU
in the new text, since IP fragmentation for IPv4 can also take place
on the intermediate routers. So, if you don't mind, I'll change the text to:

"If the size of a message is larger than the PMTU, ..."

> RFC 7383 is dated 2014, is it still applicable in 2022 ?

Yes. The problems with correct handling of IP fragments in SOHO devices
still persist, as far as I know, so RFC 7383 is still applicable. 
Most (if not all) IPsec vendors support it.

Thank you!

Regards,
Valery.