Re: [secdir] [IPsec] I-D Action: draft-harkins-brainpool-ike-groups-00.txt

[Tero Kivinen <[e-mail]>]

Dan Harkins writes:
> > I was with you until that last phrase. It most certainly is an
> > IKEv1 code point discussion.
> 
>   If you insist that the registry say "not for IKEv1" then the
> code points are not for IKEv1 and any discussion about code points
> that are not for IKEv1 is not an IKEv1 code point discussion.

That registry is for IKEv1. Meaning ANY changes to those registries
are still IKEv1 issues. Regardless whether we say that those points
are not for IKEv1 use.

Are you saying that if I want to add 2000 new cipher suites to TLS
registry (from the Specification Required space) and say that they are
not for TLS use, I do not need to ask anything from the TLS working
group?

So I myself at least do consider this to be also IKE issue even when
the groups are not for IKEv1 use, just because it changes IKEv1
registry. 

>   Please rephrase your wants into specific comments on the draft that
> I can then accept, counter, or reject. And please do not send them to
> the IPsecME list because, as you said, this "is *not* an IPsecME WG
> issue" (emphasis yours).

Remove the completely stupid "5. Insecurity Considerations" containing
your own biased opionions of the reality.

Add proper note why these things are to be added at all.

You say in the section 1 that "Other pprotocols, ...", but do not
point out any other than IEEE802.11, is there some other protocols
referencing this registry than the IEEE802.11? Also it would be better
to say that in the IEEE 802.11 only the SAE uses this registry. Also
how widely supported SAE is? I have not seen it in any of the user
interfaces for wlan systems I have configured at?

Also the point that these groups are not for IKE is bit misleading
when the title says IKE, and abstract talks about adding groups to
"registry established by Teh Internet Key Exchange (IKE)", but does
not point out that it is not for that protocol at all...

> > Whether or not you want to do those, I want the ADs to decide whether it
> > is appropriate to do more work on IKEv1, such as adding these curves to
> > the IKEv1 registries. If they think the work is appropriate, they can also
> > say where it should be done.
> 
>   They already did; you were there.

I was there too, but I think I missed it too.

Can you tell me what did they decide? Is it approriate to do any more
work on IKEv1? And if so where should it be done?
-- 
[e-mail]