Re: [IPsec] IPsec maintenance/extensions WG, summary so far

Pasi,

The ones that I actually personally care about:

> [R] o  Update to IKEv2 base specification (possible starting point:
>    draft-hoffman-ikev2bis)
>
> [CR] o  Better IPv6 configuration payloads (possible starting point:
>    draft-eronen-ipsec-ikev2-ipv6-config)
>
> [R] o  Guidelines for Mandating the Use of IPsec, for RFC430x IPsec
>    (possible starting point: draft-bellovin-useipsec)
>   

The following were also mildly interesting, I wouldn't mind if the WG
did them:

> o  IPsec document roadmap update (possible starting point: RFC 2411)
>
> o  Using AEAD algorithms in IKEv2 (possible starting point:
>    draft-black-ipsec-ikev2-aead-modes)
>
> o  Redirecting a VPN client from one gateway to another
>    (in a cluster of gateways)
>
> o  IPsec "secure beacon", or detecting whether you need VPN or 
>    not (possible starting point: draft-sheffer-ipsec-secure-beacon)
>
> o  Detecting crashed peers faster (possible starting point:
>    draft-nir-ike-qcd)
>
> o  IKEv2 session resumption / optimizing IKEv2 handshake when 
>    connecting again to same peer/cluster of peers (possible 
>    starting point: draft-sheffer-ipsec-failover)
>
> o  Authentication-only IPsec that simplifies packet inspection
>    (possible starting points: draft-hoffman-esp-null-protocol,
>    draft-grewal-ipsec-traffic-visibility)
>
> o  Using GRE "key" header field as IPsec traffic selector (possible 
>    starting point: draft-ma-softwire-ipsec-gre-demultiplexing-ps)
>
> o  Authentication with Cryptographically Generated Addresses (CGA)
>    (possible starting point: draft-laganier-ike-ipv6-cga)
>
> o  Setting up GRE tunnels with IKE (possible starting point:
>    draft-wu-l3vpn-ipsec-gre-00)
>   
Then again, much of the above is extensions, rather than fixing bugs &
revising brokenness. The latter should have priority. Is IKEv2 the only
thing that has issues in that regard?

Jari

_______________________________________________
IPsec mailing list
IPsec@ietf.org
https://www.ietf.org/mailman/listinfo/ipsec