[Ipsec] Fwd: I-D ACTION:draft-hoffman-ikev1-algorithms-00.txt

Paul Hoffman / VPNC writes:
> Greetings again. We have talked for over five years about getting rid 
> of 56-bit DES in IKEv1. So, I have (belatedly) written a draft on 
> doing this at the same time as updating the other algorithm MUSTs and 
> SHOULDs. This is a personal draft, not a WG item, but it can be 
> discussed on this list before I turn it into the IESG as a personal 
> submission.
> 
> Comments are appreciated.

The document seems fine. Perhaps add reference to the NIST
announcement of documenting the removal of DES or so might be good
idea. Also adding "authentication via pre-shareed keys" to both
sections 2 and 3 would be good, so all the requirements are there. Now
that is the only one that is left out, as it is not changing. 

I would actually like to make AES a next MUST cipher, and I do not see
problem that we refer new documents here. We are still updating
RFC2409 aren't we?

Anyways, this will update the ciphers used in the IKEv1 SA, but it
does not change the ciphers used in the IPsec SAs. If you want to do
that too, you need to update the RFC2407 too.

RFC2407 current lists mandatory algorithms as AH with MD5, AH with
SHA1, ESP with DES and HMAC-MD5, ESP with NULL cipher.

The RFC2406 also lists mandatory algorithms for ESP, i.e it lists: DES
in CBC mode, HMAC with MD5, HMAC with SHA-1, NULL authentication
algorithm and NULL encryption algorithm.

And the RFC2402 lists mandatory algorithms for AH, i.e. it lists; HMAC
with MD5 and SHA-1.
-- 
kivinen@safenet-inc.com

_______________________________________________
Ipsec mailing list
Ipsec@ietf.org
https://www1.ietf.org/mailman/listinfo/ipsec