Subject: [IPsec] Obsolete Statements in RFC4306 (IKEv2)

From: Chinh Nguyen <[email-masked]>
Date: Thu, 20 Mar 2008 10:14:29 -0400

Given this clarification in rfc 4718:
<<
    Moreover, the combination of ESP and AH (between the same endpoints)
    had already become largely obsolete in 1998 when RFC 2406 was
    published.  Our recommendation is that IKEv2 implementations should
    not support this combination, and implementers should not assume the
    combination can be made to work in an interoperable manner.

Are the following statements obsolete in rfc 4306:

<<
IKE can also
    negotiate use of IP Compression (IPComp) [IPCOMP] in connection with
    an ESP and/or AH SA.

should be "ESP or AH SA"

<<
  When
    SAs are nested, as when data (and IP headers if in tunnel mode) are
    encapsulated first with IPComp, then with ESP, and finally with AH
    between the same pair of endpoints, all of the SAs MUST be deleted
    together.

should be "first with IPComp, then with ESP or AH"

<<
If two successive structures have the same
    Proposal number, it means that the proposal consists of the first
    structure AND the second.  So a proposal of AH AND ESP would have two
    proposal structures, one for AH and one for ESP and both would have
    Proposal #1.

(In fact, support for proposals with same number not necessary at all. 
The only other usage I can think of, IPCOMP, is now a NOTIFY payload).

Chinh
--
http://www.certicom.com
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec