Subject: [IPsec] I-D Action:draft-ietf-ipsecme-failure-detection-00.txt

From: [email-masked]
Date: Thu, 2 Sep 2010 15:15:01 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the IP Security Maintenance and Extensions Working Group of the IETF.

	Title           : A Quick Crash Detection Method for IKE
	Author(s)       : Y. Nir, D. Wierbowski
	Filename        : draft-ietf-ipsecme-failure-detection-00.txt
	Pages           : 21
	Date            : 2010-09-02

This document describes an extension to the IKEv2 protocol that
allows for faster detection of SA desynchronization using a saved
token.

When an IPsec tunnel between two IKEv2 peers is disconnected due to a
restart of one peer, it can take as much as several minutes for the
other peer to discover that the reboot has occurred, thus delaying
recovery.  In this text we propose an extension to the protocol, that
allows for recovery immediately following the restart.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-ipsecme-failure-detection-00.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.

---

From: Scott C Moonen <[email-masked]>
Date: Fri, 3 Sep 2010 15:43:22 -0400

Looks good.  I have one technical question:

- What is the purpose of sending an empty response to the unprotected N
(INVALID[_IKE]_SPI)&N(QCD_TOKEN)+ message?  I'm not sure it provides any
real value and would really prefer not to send it.  Also, this contradicts
a few "MUST NOT" statements in ikev2bis concerning how we handle
unprotected messages; if the consensus is to keep this behavior then we
should make clear that we are self-consciously breaking the rules here.

And some editorial nits:

- A couple of block quotes seem to have an extraneous first-line indent.
They are "If this Informational Message . . ." and "It is suggested . . . "
- Instead of "dependant" (generally used only as a noun) we should use
"dependent".
- I don't think that the MAY in "MAY send this notification freely" should
be capitalized.  It does not sound normative to me.  If we want to make it
normative I suggest we say "token maker" rather than "peer," and specify
SHOULD instead.
- Capitalization: need lowercase 't' in "The IKE SPI and message ID . . ."
- Count: Replace "Two method" with "Two methods"
- Suggest "requirements of" or "requirements for" in place of "requirements
from"
- Suggest removing a few extraneous commas: "The token maker, MUST" and
"such, that" and "help, is"

Scott Moonen ([email-masked])
z/OS Communications Server TCP/IP Development
http://www.linkedin.com/in/smoonen

From:	[email-masked]
To:	[email-masked]
Cc:	[email-masked]
Date:	09/02/2010 06:16 PM
Subject:	[IPsec] I-D Action:draft-ietf-ipsecme-failure-detection-00.txt
Sent by:	[email-masked]

A New Internet-Draft is available from the on-line Internet-Drafts
directories.
This draft is a work item of the IP Security Maintenance and Extensions
Working Group of the IETF.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
ftp://[email-masked]/internet-drafts/draft-ietf-ipsecme-failure-detection-00.txt
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Sat, 4 Sep 2010 11:34:52 +0300

Hi Scott.

On Sep 3, 2010, at 10:43 PM, Scott C Moonen wrote:

> - What is the purpose of sending an empty response to the unprotected N(INVALID[_IKE]_SPI)&N(QCD_TOKEN)+ message? I'm not sure it provides any real value and would really prefer not to send it. Also, this contradicts a few "MUST NOT" statements in ikev2bis concerning how we handle unprotected messages; if the consensus is to keep this behavior then we should make clear that we are self-consciously breaking the rules here.

OK. I've opened ticket 189 for this.
http://trac.tools.ietf.org/wg/ipsecme/trac/ticket/189

> And some editorial nits:
> 
> - A couple of block quotes seem to have an extraneous first-line indent. They are "If this Informational Message . . ." and "It is suggested . . . "

I've copied them from "official" text version of the draft, without reflowing the text. Looks really cool in the HTML version.

> - Instead of "dependant" (generally used only as a noun) we should use "dependent".

Will fix in -01

> - I don't think that the MAY in "MAY send this notification freely" should be capitalized. It does not sound normative to me. If we want to make it normative I suggest we say "token maker" rather than "peer," and specify SHOULD instead.

I agree. Unless someone objects, I will make it lower case in -01.

> - Suggest "requirements of" or "requirements for" in place of "requirements from"
> - Suggest removing a few extraneous commas: "The token maker, MUST" and "such, that" and "help, is"

Will fix all of these in -01.