Subject: RE: Issue5 and ECN

From: [email-masked]
Date: Tue, 1 Jul 2003 12:33:51 -0400

Tero,

> When checking issue 5 "ECN text in USE_TRANSPORT_MODE" I read 
> the section "2.24 ECN Notification". While reading it, I 
> noticed that the section DOES NOT have anything to do with 
> IKEv2, it only modifies some other documents (RFC2401 and RFC3168).

Actually it does.  IKEv1 had to negotiate ECN usage because
one couldn't know whether the other end of the tunnel handled
ECN correctly.  For IKEv2 that negotiation is avoided by equating
"other end of tunnel handles ECN correctly" with "other end of
tunnel uses IKEv2 to create tunnel SA" (i.e., use of IKEv2
promises correct ECN handling).
 
> I think that whole section should be removed, and moved to 
> the RFC2401bis instead. Earlier it was little bit different 
> because the support for ECN was negotiated in the IKEv1, but 
> now it is on by default, so I do not think we need anything 
> more in IKEv2 document than the text saying that the ECN 
> support should be done as defined in the RFC2401bis.

That's ok if the WG can tolerate a normative reference from
IKEv2 to 2401bis (i.e., can't publish IKEv2 RFC until 2401bis
RFC is published).  Avoiding this was the primary reason that
the ECN text was pulled into IKEv2.

> It makes quite hard for implementators if they have to read 
> unrelated documents (IKEv2) to see how to process ECN 
> modifiers instead of reading how to handle them from the 
> IPsec architecture document or the document which describes the ECN. 

I believe the intent is to put the ECN text into 2401bis regardless
(so I agree with your new item for 2401bis).  The ECN text is
currently also in IKEv2 for the above timing/normative reference
reasons. I have no issue with putting the ECN text solely in 2401bis
if the normative reference from IKEv2 to 2401bis is acceptable.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 1 Jul 2003 20:27:03 +0300

> if the normative reference from IKEv2 to 2401bis is acceptable.

I think there is no other choice than to put normative reference to
2401bis from IKEv2. The TOS traffic selectors, red-side fragmentation,
all selectors being ranges etc are all of RFC2401bis changes that
are also changes to IKEv2 too. 
-- 
[email-masked]
SSH Communications Security                  http://www.ssh.fi/
SSH IPSEC Toolkit                            http://www.ssh.fi/ipsec/