Subject: [IPsec] Issue #29 Need to clarify Exchange Type field

From: Tero Kivinen <[email-masked]>
Date: Tue, 23 Sep 2008 15:35:21 +0300

> >     o  Exchange Type (1 octet) - Indicates the type of exchange being
> >        used.  This constrains the payloads sent in each message and
> >        orderings of messages in an exchange.
> 	^^^^^^^^^
> 
> What does that try to say?
> 
> ===Not done. It is saying that exchange types can impose orderings.

Then I think it is not really true. Each exchange consists of request
and reply pair, and exchanges can follow each other in certain order,
but as there is only 2 messages in an exchange (one request and one
reply), I do not think exchange type can really constraint order of
the messages in an exchange (ok, I think it is implictly understood
that request comes before reply, and you are not allowed to respond
with a reply to request, before the request is sent, but I still think
the word there is just confusing and not helping at all).

Section 1 explains exchange to be:

   All IKE communications consist of pairs of messages: a request and a
   response.  The pair is called an "exchange".

So no exchange can have more than 2 messages.
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 23 Sep 2008 15:56:00 -0700

>So no exchange can have more than 2 messages.

My mistake. I thought EAP authentication was done in "an exchange",

I have made the above change, and have replaced "EAP exchange" in the 
security considerations with better language.

--Paul Hoffman, Director
--VPN Consortium

---

From: Yoav Nir <[email-masked]>
Date: Wed, 24 Sep 2008 08:42:40 +0300

On Sep 24, 2008, at 1:56 AM, Paul Hoffman wrote:

> I have made the above change, and have replaced "EAP exchange" in  
> the security considerations with better language.

I understood it the same way as Paul. This makes the term "exchange"  
much less useful. For example, in the EAP case traffic selectors are  
proposed in one exchange, while the reply with the final selectors  
comes in a totally different exchange. This doesn't make much sense.  
The several request-reply pairs there are all related in that they  
negotiate the same thing, and up to now, I thought the term for this  
was "exchange".

I would rather re-define "exchange" so that all the IKE_AUTH round- 
trips are one exchange rather than having to invent a new concept  
(maybe revive the term "mode") to define the state machine for  
authentication.  Obviously that state machine can't reach a final  
state after the first response.
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Wed, 24 Sep 2008 07:30:03 -0700

At 8:42 AM +0300 9/24/08, Yoav Nir wrote:
>I would rather re-define "exchange" so that all the IKE_AUTH 
>round-trips are one exchange rather than having to invent a new 
>concept (maybe revive the term "mode") to define the state machine 
>for authentication.  Obviously that state machine can't reach a 
>final state after the first response.

Actually, "EAP exchange" was only used twice, both times in the 
security considerations section. We got it right in the main EAP 
section.

--Paul Hoffman, Director
--VPN Consortium