Subject: [IPsec] a new IKEv2 labeled security draft is published

From: "[email-masked]" <[email-masked]>
Date: Wed, 28 Jul 2010 00:30:08 -0700

A new 00 version of IKEv2 extension for security label has just been 
published:

http://tools.ietf.org/html/draft-jml-ipsec-ikev2-security-label-00

Authors welcome comments from IPsec community.

Thanks.

- Jarrett

---

From: Yoav Nir <[email-masked]>
Date: Wed, 28 Jul 2010 19:26:37 +0300

> Authors welcome comments from IPsec community.

You will get that, but first, please tell us your plans for this.

Would you like to get this published as individuals/independant, or do you plan to try again to have this accepted into the IPSecME agenda?

---

From: "[email-masked]" <[email-masked]>
Date: Wed, 28 Jul 2010 09:37:50 -0700

> Would you like to get this published as individuals/independant, or do you plan to try again to have this accepted into the IPSecME agenda?

Sorry I didn't make it clear earlier. It's intended to be an individual 
submission and will become an experimental RFC.

Thanks.

Jarrett

---

From: "David P. Quigley" <[email-masked]>
Date: Wed, 28 Jul 2010 13:59:46 -0400

> Would you like to get this published as individuals/independant, or do you plan to try again to have this accepted into the IPSecME agenda?

As Jarrett mentioned down thread this is not intended to become an
IPSecME working group item. I spoke with Paul Hoffman at Anaheim about
the correct path forward for this document. He gave us some advice for
making the document more easily reviewed (remove ikev1, and SA text). He
also said that the best course of action would be an Individual
submission on either an Experimental or Informational RFC track. He
mentioned that this would require review from the working group and if
the working group later decided that the work is baked enough and has
enough backing to become a working group item they could move it from an
individual submission to an IPSecME working group document. The most
important thing at the moment is to get the technology thoroughly
reviewed by as many people as possible. This way we can make sure that
all of the protocol decisions that we've made are well thought out and
are an acceptable way of doing things.

Dave

---

From: Paul Moore <[email-masked]>
Date: Fri, 30 Jul 2010 16:49:42 -0400

> Authors welcome comments from IPsec community.

Having just read the draft I think it is a bit difficult to perform any
in-depth review without the LFS document (which is described as a work
in progress); there just isn't any real substance in this draft in my
opinion.

That said, I did notice two things while reading the draft:

* Beyond some grammatical issues in the Introduction, it is probably
better to say that SELinux implements a Flask security architecture
rather than just type enforcement[1].

 -> http://www.cs.utah.edu/flux/fluke/html/te.html

* There appears to be a stray line referencing RFC 4301 in the
References section at the end of the draft.

-- 
paul moore
linux @ hp