Subject: [IPsec] For Ahmad's benefit

From: Lakshminath Dondeti <[email-masked]>
Date: Tue, 18 Nov 2008 07:49:08 -0800

It's still possible that I haven't read my own draft.  I just wrote it 
:).  So, for Ahmad's benefit, here are some excerpts:

"This document specifies a new IKEv2 exchange type called
    IKE_SESSION_RESUME whose value is TBA by IANA.  This exchange is
    somewhat similar to the IKE_AUTH exchange, and results in the
    creation of a Child SA. "

Here is how it looks like and you might notice the similarity to IKE_AUTH:

"HDR, Ni, N(TICKET_OPAQUE), [N+,]
          SK {IDi, [IDr,] SAi2, TSi, TSr [, CP(CFG_REQUEST)]} -->"

"4.2.1. Protection of the IKE_SESSION_RESUME Exchange

    The two messages of this exchange are protected by a "subset" IKE SA.
    The key material is derived from the ticket, as follows:"

So, at this point, I wonder whether the question was about how the 
Session resumption exchange is protected.

best,
Lakshminath
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: "Ahmad Muhanna" <[email-masked]>
Date: Tue, 18 Nov 2008 10:10:39 -0600

Hi Lakshminath,

As I said, all the text you captured assumed the ticket contain a value
NOT a reference. Please take a look at Pasi's posting and my reply.
Basically in order to be clear enough and reduce a lot of exchange, the
draft is written with one type of ticket is in mind. "TICKET with VALUE"

I suggest that the draft be rewritten with both types of tickets in mind
as the draft itself ALLOWS.

Cheers!

Regards,
Ahmad

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] 
> On Behalf Of Lakshminath Dondeti
> Sent: Tuesday, November 18, 2008 9:49 AM
> To: [email-masked]
> Subject: [IPsec] For Ahmad's benefit
> 
> It's still possible that I haven't read my own draft.  I just 
> wrote it :).  So, for Ahmad's benefit, here are some excerpts:
> 
> So, at this point, I wonder whether the question was about 
> how the Session resumption exchange is protected.
> 
> best,
> Lakshminath

---

From: Lakshminath Dondeti <[email-masked]>
Date: Tue, 18 Nov 2008 08:19:26 -0800

But, the contents of the ticket are not necessarily privy to the client. 
  Pasi's explanation works for you perhaps?

best,
Lakshminath