Re: [IPsec] Review of draft-ietf-ipsecme-ikev2-null-auth

[Paul Hoffman <[e-mail]>]

On Feb 27, 2015, at 1:58 PM, Yaron Sheffer <[e-mail]> wrote:
> 
>> 
>> That's a good question, and you can see it both ways.
>> 
>> - The draft says that the PAD processing in RFC 4301 needs to be updated for this draft, so the draft updates RFC 4301.
>> 
>> - Implementations of RFC 4301 that do not care about IKEv2 using this draft should not be updated, so this draft doesn't update 4301, just the 4301 processing when using IKEv2 and this draft.
>> 
>> I tend toward the second interpretation, but am happy either way. What do others think?
>> 
>> --Paul Hoffman
> 
> I tend the other way, so we need an example or two. If you read the abstract of RFC 6040, it says: "On decapsulation, [RFC 6040] updates both RFC 3168 and RFC 4301 to add new behaviours for previously unused combinations of inner and outer headers." Which means that even though existing implementations are not affected until they encounter these new message variants, we use "Updates" because new implementations are expected to include the new behavior.

That's an interesting example, one from outside our WG. Note, however, that RFC 6040 is the *only* RFC that updates RFC 4301 so far. It seems odd that it is the only one like this draft that says "and you need to change your PAD processing for this new thing".

--Paul Hoffman