Re: [Ipsec] Two IKEv2 issues from the IESG

Michael Richardson writes:
>   I think that you mean "datagram" -- seeing as a 3000 byte datagram would
> exceed common MTU, it must have been fragmented into multiple frames to
> have been received.
> 
>   The above (corrected) statement also implies to me that an IKEv2 and
> host must be prepared to re-assemble at least 3000 bytes bytes worth of
> fragment.

Yes. That was my intention, meaning that all implementations of IKEv2
SHOULD also supoprt IP fragmentation in their end. There might be
nodes between which make it impossible to use fragmentation (firewalls
/ NATs etc), but I think we should require that our own end is working
in this case. I have seen IKEv1 implementation which implemented their
own IP / UDP code which didn't include any reassembly at all. I do not
want to that happen in the IKEv2. 

>     Russ> I suggest the removal of the elliptic curve groups from
>     Russ> Appendix B.
> 
>   I don't object.

Same here. It really does not matter if they are there or not. If they
are there, then it might be easier for people to define more of them
later, as the document also describes what to put in the KE payload,
so if we remove the groups, do we also remove this text from
draft-ietf-ipsec-ikev2-15.txt:
----------------------------------------------------------------------
   The data in the KE payload when using this group is the value x from
   the solution (x,y), the point on the curve chosen by taking the
   randomly chosen secret Ka and computing Ka*P, where * is the
   repetition of the group addition and double operations, P is the
   curve point with x coordinate equal to generator 1 and the y
   coordinate determined from the defining equation. The equation of
   curve is implicitly known by the Group Type and the A and B
   coefficients. There are two possible values for the y coordinate;
   either one can be used successfully (the two parties need not agree
   on the selection).
-- 
kivinen@safenet-inc.com

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec