IETF Logo Mail Archive

Re: [IPsec] #119: Which certificate types can be mixed in one exchange?

Yaron Sheffer <yaronf@checkpoint.com> Tue, 24 November 2009 17:10 UTC

Return-Path: <yaronf@checkpoint.com>
X-Original-To: ipsec@core3.amsl.com
Delivered-To: ipsec@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 315973A6B6F for <ipsec@core3.amsl.com>; Tue, 24 Nov 2009 09:10:40 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.503
X-Spam-Level:
X-Spam-Status: No, score=-3.503 tagged_above=-999 required=5 tests=[AWL=0.095, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id kRL-7kL4mYq7 for <ipsec@core3.amsl.com>; Tue, 24 Nov 2009 09:10:35 -0800 (PST)
Received: from michael.checkpoint.com (michael.checkpoint.com [194.29.32.68]) by core3.amsl.com (Postfix) with ESMTP id 0406828C129 for <ipsec@ietf.org>; Tue, 24 Nov 2009 09:10:32 -0800 (PST)
Received: from il-ex01.ad.checkpoint.com (localhost [127.0.0.1]) by michael.checkpoint.com (8.12.10+Sun/8.12.10) with ESMTP id nAOH9JGs011035 for <ipsec@ietf.org>; Tue, 24 Nov 2009 19:09:21 +0200 (IST)
Received: from il-ex01.ad.checkpoint.com ([126.0.0.2]) by il-ex01.ad.checkpoint.com ([126.0.0.2]) with mapi; Tue, 24 Nov 2009 19:09:26 +0200
From: Yaron Sheffer <yaronf@checkpoint.com>
To: IPsecme WG <ipsec@ietf.org>
Date: Tue, 24 Nov 2009 19:09:25 +0200
Thread-Topic: #119: Which certificate types can be mixed in one exchange?
Thread-Index: AcpY7RujsaPOPWKnQK+8SRjY4rhHTgUOhcVA
Message-ID: <7F9A6D26EB51614FBF9F81C0DA4CFEC801BDF88DFFE3@il-ex01.ad.checkpoint.com>
References: <7F9A6D26EB51614FBF9F81C0DA4CFEC801BDA1213EAB@il-ex01.ad.checkpoint.com>
In-Reply-To: <7F9A6D26EB51614FBF9F81C0DA4CFEC801BDA1213EAB@il-ex01.ad.checkpoint.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
acceptlanguage: en-US
Content-Type: multipart/alternative; boundary="_000_7F9A6D26EB51614FBF9F81C0DA4CFEC801BDF88DFFE3ilex01adche_"
MIME-Version: 1.0
Subject: Re: [IPsec] #119: Which certificate types can be mixed in one exchange?
X-BeenThere: ipsec@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/ipsec>
List-Post: <mailto:ipsec@ietf.org>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/ipsec>, <mailto:ipsec-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 24 Nov 2009 17:10:40 -0000

There was very limited discussion of this issue, which I see as the main reason why Sec. 3.6 is underspecified. If my proposal below is too restrictive we can expand it somewhat but still keep the number of possible combinations at a level where testing (and interoperability) is possible.

David also asked whether we'd want to fold RFC 4806 (OCSP extensions to IKEv2) into -bis. My personal opinion is No, despite the fact that it is a Proposed Standard.

________________________________
From: ipsec-bounces@ietf.org [mailto:ipsec-bounces@ietf.org] On Behalf Of Yaron Sheffer
Sent: Friday, October 30, 2009 1:18
To: IPsecme WG
Subject: [IPsec] #119: Which certificate types can be mixed in one exchange?


Should be added to Sec. 3.6, probably as a new subsection.

One Hash & URL (H&U) bundle only. Or...

One Raw RSA key, or...

One or more cert payloads of either type 4 or H&U (type 12)

Can have one or more CRLs and/or OCSP content (RFC 4806<http://tools.ietf.org/html/rfc4806>) added to any of the above, except for Raw RSA.



Scanned by Check Point Total Security Gateway.

v2.23.0 | Report a Bug | By Email