Subject: Re: [IPsec] Secure Crash Discovery for IKEv2

From: Yoav Nir <[email-masked]>
Date: Tue, 9 Sep 2008 16:17:54 +0300

Hi all

I sent out this email about a month ago, and the response was, well,  
underwhelming.

We had three responses: one for QCD, one just asking a question, and  
one questioning the need and suggesting that we revive the birth  
certificate idea instead of the two proposed solutions.

Despite this, we still believe this is important for IKE  
implementations, and would like to proceed. A "nightmare scenario" for  
us is to have two competing non-interoperable standards. We had hoped,  
that even though this is not a charter item, and we can't call on the  
group to force a consensus, that we'd hear from enough people to get a  
feel for the opinion of the WG.

So we're asking the participants of this WG again for their opinion  
about the two (well, three if you include birth certificates) options  
for solving the de-synchronization problem.

Thanks in advance

Frederic, Pratima and Yoav

On Aug 6, 2008, at 5:22 PM, Yoav Nir wrote:

> This is a followup to my mini-presentation in Dublin.
>
> The problem we're trying to solve is that of a state de- 
> synchronization between two IKE peers. This could take several  
> minutes to discover and resolve, and no IPsec traffic can flow in  
> that time.
>
> The following Wiki page describes the problem, and two proposed  
> solutions.
>
> http://wiki.tools.ietf.org/wg/ipsecme/trac/wiki/SecureCrashDiscovery
>
> We would like to solicit input from the WG about these two  
> solutions, so that we can either combine them or choose between  
> them, and proceed with a unified draft.
>
> Thanks in advance
>
> Frederic, Pratima and Yoav

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 9 Sep 2008 16:56:32 +0300

> feel for the opinion of the WG.

So are we planning to run all NON-WG items also through the WG, or
would it be better to first discuss here whether there is problem that
needs to be solved in the WG and if there is problem, then put solving
that problem to charter AFTER we have finshed first items in the
current charter.

> for solving the de-synchronization problem.

I myself think birth certificates would be the best option, but as I
have been to busy with other working group items I have not been able
to start thinking this issue yet.
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Tue, 9 Sep 2008 17:16:10 +0300

> that problem to charter AFTER we have finshed first items in the

Sure. Just like the RoHC-over-IPsec, also not an IPSECME WG item, is  
also discussed here. Paul even said it was OK to discuss the non-WG  
items that are related to IPsec as long as we don't hog all the  
bandwidth. Of course, opinions that there's not really a problem are  
also welcome.

> to start thinking this issue yet.

So birth certificates are the solution to this non-existing problem?
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 9 Sep 2008 17:39:40 +0300

Yoav Nir writes:
> also discussed here.

The RoHC-over-IPsec is ROHC WG item and is closing to its WG LG, so I
think now is the good time for the IPsec people to check out those.
The discussion was on both rohc and ipsec lists. The rohc items do
have higher priority than the secure crash discovery in my personal
todo list.

> Paul even said it was OK to discuss the non-WG  
> bandwidth.

Sure, but I just replied why I have not used time to think about the
problem yet. I have not yet even tought whether the problem really
exists, and what kind of solution is needed for it. Usually the
solution depends what is the real problem we are tring to solve. 

> Of course, opinions that there's not really a problem are  
> also welcome.

I have expressed that opinion too. See my email
http://www.ietf.org/mail-archive/web/ipsec/current/msg03009.html.

> So birth certificates are the solution to this non-existing problem?

Birth certificates might be solution to some problem, but as I am not
sure what problem we are solving, and I do not have time to start
really thinking this now, I cannot comment whether the problem exists
or whether birth certificates are solution to that problem. Others are
free to use time for this, I just expressed my opinion that it might
be better to first get some of the real wg items out and then think
the real problem we are trying to solve, i.e are we trying to recover
in less than 1, 10, 30 or 60 seconds (for 60 seconds we do not need
any changes to the protocol, just more clever implementations), are we
really trying to recover back to same gw (which means anything faster
than 60 seconds is wasted as the gateway most likely takes about 60
seconds to get up) or different gw and so on?
-- 
[email-masked]
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 9 Sep 2008 08:53:34 -0700

>that problem to charter AFTER we have finshed first items in the

We are *allowing* IPsec-related topics that are not in our charter to 
be discussed on the list as long as such discussion does not get in 
the way of topics in our charter. The hope here is that if there is a 
topic or individual draft that has a lot of contention, a separate 
mailing list could be set up for that topic and summaries of the 
discussion sent to the WG mailing list.

--Paul Hoffman, Director
--VPN Consortium