Re: [IPsec] Mirja Kühlewind's No Objection on draft-ietf-ipsecme-qr-ikev2-10: (with COMMENT)

[Paul Wouters <[e-mail]>]

> On Jan 8, 2020, at 04:41, Mirja Kuehlewind <[e-mail]> wrote:
> 
>> 
>> I think one or two RTT is too short, moreover since it's an initial request,
>> no RTT is yet measured (IKEv2 uses UDP as primary transport).
>> We try here to be in line with core IKEv2 spec, which deliberately 
>> doesn't give any concrete figures of how long to wait for an response
>> (section 2.4 of RFC7296). So, I'd leave the text as is.
> 
> Kind of same here. Given you two disagree here already, I think it would be good to give further advise.

I agree with Valerie. We don’t do that on purpose. A 100gbps connection is different from a satellite connection. Let the implementation handle that part.


>> I agree with Panos: the downgrade is possible only if using PPK is optional
>> for both, in which case both parties agree that downgrade is OK.
> 
> Having some downgrade detection would enable to log an attack if optional PPK was used.

That would be lost in the noise when using mixed ppl/noppk use I think. As said, one is expected to only allow noppk during migration, which would be very limited in time (like hours or days for static tunnels, maybe weeks or a few months for remote access VPN updates to happen)

Paul