Re: [saag] looking to hold a TLS VPN side meeting at IETF 92

[Aaron Zauner <[e-mail]>]

Hi Tero,

* Tero Kivinen <[e-mail]> [19/03/2015 12:21:36] wrote:
> Actually it is implementors fault, as they use obsoleted IKEv1
> protocol. IKEv2 obsoleted IKEv1 in 2005, but now ten years later,
> people are still using old version. IKEv2 fixed lots of issues in
> IKEv1, especially in the configuration end, for example making things
> like lifetimes local matter, so user does not need to configure or
> care about them, and they will not cause interoperability issues. Also
> things like you must use aggressive mode with road warriors with
> pre-shared keys went away, and the IP-address assignment and EAP in
> the base standard there is no need for non-interable versions of xauth
> and cfg-mode.
> 
> The problem is that with all its problems the IKEv1 still works "well"
> enough, that even if implementors implement IKEv2 they do not turn it
> on by default, i.e. they usually first try IKEv1. This means those
> implementations do not benefit from features provided by IKEv2.

I don't disagree, see previous mails and below. That being said,
it's still unclear to me why something like IKEv1 has been proposed
and standardized at all, but that was long before my time. Protocol
upgrades are a big issue throughout working groups and
implementations.

> How about proposing using non-obsoleted protocol, instead of proposing
> protocol that was obsoleted more than ten years ago? If the
> implementation you plan to use only supports IKEv1, then you know it
> has not been updated in last ten years, thus most likely it is not
> secure anymore.

This certainly wasn't my proposal. The issue I see is that a lot of
operating systems (not appliances) will default to IKEv1 or only
support IKEv1 (in the case of Apple). Thus the common denominator is
still IKEv1. I'd be happy to help design products that support
IKEv2. As is (i.e. without shipping a seperate application to
endusers) there's no real way to do that -- at least that I'm aware
of.

(We're going off-topic here, I'd suggest off-list CCs)

Aaron