Subject: [IPsec] Fwd: I-D Action:draft-nir-qcr-00.txt

From: Yoav Nir <[email-masked]>
Date: Sun, 16 Mar 2008 16:59:38 +0200

Hello all

The draft below describes a problem that IMO delays crash recovery in  
IKEv2. It also proposes a solution.

Please send comments to the list and/or directly to me.

Yoav

Begin forwarded message:

> From: [email-masked]
> Date: March 16, 2008 4:45:01 PM GMT+02:00
> To: [email-masked]
> Subject: I-D Action:draft-nir-qcr-00.txt
> Reply-To: [email-masked]
>
> A New Internet-Draft is available from the on-line Internet-Drafts  
> directories.
>
> 	Title           : A Quick Crash Recovery Method for IKE
> 	Author(s)       : Y. Nir
> 	Filename        : draft-nir-qcr-00.txt
> 	Pages           : 12
> 	Date            : 2008-03-16
>
> This document describes an extension to the IKEv2 protocol that
> allows for faster crash recovery using a saved token method.
>
> When an IPsec tunnel between two IKEv2 implementations is
> disconnected due to a restart of one peer, it can take as much as
> several minutes to recover.  In this text we propose an extension to
> the protocol, that allows for recovery within a few seconds of the
> reboot.
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-nir-qcr-00.txt
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> Below is the data which will enable a MIME compliant mail reader
> implementation to automatically retrieve the ASCII version of the
> Internet-Draft.
> _______________________________________________
> I-D-Announce mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/i-d-announce
> Internet-Draft directories: http://www.ietf.org/shadow.html
> or ftp://ftp.ietf.org/ietf/1shadow-sites.txt
>
>
> Scanned by Check Point Total Security Gateway.

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: <[email-masked]>
Date: Fri, 28 Mar 2008 15:54:06 +0200

Hi Yoav,

An interesting idea!

I haven't really reviewed the details, but I have one small comment:
there's no such thing as an unprotected informational exchange in
IKEv2. There's only a one-way unprotected notification, but it's never
replied to (see RFC 4306, Section 1.5).

Best regards,
Pasi 

-----Original Message-----
> From: Yoav Nir
> Sent: 16 March, 2008 17:00
> To: [email-masked]
> Subject: [IPsec] Fwd: I-D Action:draft-nir-qcr-00.txt
> 
> Hello all 
>
> The draft below describes a problem that IMO delays crash recovery
> in IKEv2. It also proposes a solution.
>

---

From: Yoav Nir <[email-masked]>
Date: Fri, 28 Mar 2008 23:45:07 +0300

OK. I will correct the terminology. The QCR_TOKEN in the unprotected  
notification does not get a reply anyway, so it's not a problem.

I also plan to make some other changes:
- change the name to something like draft-nir-ike-qcr... to avoid  
making it look like I'm inventing a whole new thing for the Internet
- add discussion of session resumption (IFARE) because the IFARE  
people think it looks like it's a competing proposal
- I thought of changing the name to QCD for quick crash Discovery,  
because the method really only buys you crash discovery. Recovery is  
done through a regular IKE exchange or through a low-resource IKE  
exchange using IFARE.

On Mar 28, 2008, at 4:54 PM, <[email-masked]> <[email-masked] 
 > wrote: