[Ipsec] draft-ietf-ipsec-ikev2-15.txt

["Charlie Kaufman" <[e-mail]>]

I submitted revision -15 of the IKEv2 spec to the Internet Drafts editor
(copying Paul Hoffman in hopes he will make it available more quickly).
It addresses all of the outstanding issues in the issues tracker. Below
is the list of changes.

Some changes were based on hallway discussions at IETF, and should be
ratified as appropriate on this list. If they are, this might (finally!)
be the version that becomes an RFC. The change most likely to be
controversial is that the "Hash and URL" encoding of certificates is
made mandatory to support in an implementation (though not mandatory to
configure). This was to address a large number of concerns about use of
IP fragmentation for what might turn out to be large packets when
certificates are included. IP fragmentation opens implementations up to
denial of service attacks, and they are blocked by some firewalls.

The only other "bits on the wire" change was in how IPv6 addresses are
assigned when a mobile endpoint tunnels into a firewall. The new
mechanism allows the mobile endpoint to request a specific set of low
order bytes. (Technically, it's not a change; just a 'clarification' of
how the request for an address should be interpreted).

	--Charlie
   

   1) ISSUE #111, 113: Made support for "Hash and URL" as a substitute
   for certificates mandatory, and added explanatory text about the
   dangers of depending on IP fragmentation for large messages.

   2) ISSUE #110: Made support for configuring shared keys by means of a
   HEX encoded byte string mandatory.

   3) Clarified use of special traffic selectors with a port range from
   65535 - 0.

   4) ISSUE #110: Added reference to RFC2401bis for definitions of
   terms.

   5) ISSUE #110, 114: Made required support of ID_IPV4_ADDR and
   ID_IPV6_ADDR depend on support of IPv4 vs. IPv6 as a transport.

   6) ISSUE #114: Removed INTERNAL_IP6_NETMASK and replaced it with text
   describing how an endpoint should request an IP address with
   specified low order bytes.

   7) ISSUE #101, 102, 104, 105, 106, and 107: Fold in information from
   draft-ietf-ipsec-ikev2-iana-00.txt to make that document unnecessary
   for initial IANA settings. Deleted it from references.

   8) ISSUE #110: Removed reference to ENCR_RC4.

   9) ISSUE #112: Removed reference to draft-keromytis-ike-id-00.txt,
   which will not be published as an RFC.

   10) ISSUE #112: Removed text incorrectly implying that AH could be
   tunneled over port 4500.

   11) ISSUE #112: Removed reference to draft-ietf-ipsec-nat-
   reqts-04.txt.

   12) ISSUE #112: Removed reference to draft-ipsec-ike-hash-
   revised-02.txt, and substituted a short explanation of the problem
   addressed.

   13) ISSUE #112: Changed the label of PRF_AES_CBC to PRF_AES128_CBC

   14) ISSUE #110: Clarified distinction between Informational messages
   and Informational exchanges.

   15) ISSUE #110: Clarified distinction between SA payloads and SAs.

   16) ISSUE #109: Clarified that cryptographic algorithms that MUST be
   supported can still be configured as off.

   17) ISSUE #110: Changed example IP addresses from 10.*.*.* to
   192.0.*.*.

   18) ISSUE #108: Rephrased to avoid use of the undefined acronyms PFS
   and NAT-T.

   19) ISSUE #113: Added requirement that backoff timers on
   retransmissions must increase exponentially to avoid network
   congestion.

   20) Replaced dubious explanation of NON_FIRST_FRAGMENTS_ALSO with a
   reference to RFC2401bis.

   21) Fixed 16 spelling/typographical/gramatical errors.


_______________________________________________
Ipsec mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/ipsec