Subject: [IPsec] comments on graveyard draft, became Re: Delivery Notification: Delivery has failed

From: Dan Harkins <[email-masked]>
Date: Mon, 08 Mar 2021 06:46:54 -0800

Oh for gaia's sake....

On 3/8/21 6:33 AM, PMDF Internet Messaging wrote:
> This report relates to a message you sent with the following header fields:
>
>    Message-id: <[email-masked]>
>    Date: Mon, 08 Mar 2021 06:33:15 -0800
>    From: Dan Harkins <[email-masked]>
>    To: Paul Wouters <[email-masked]>
>    Subject: comments on graveyard draft
>
> Your message cannot be delivered to the following recipients:
>
>    Recipient address: [email-masked]
>    Reason: Remote SMTP server has rejected address
>    Diagnostic code: smtp;550 5.7.1 <[email-masked]>: Sender address rejected: Exercising my freedom to not hear you scream
>    Remote system: dns;mx.nohats.ca (TCP|198.137.202.94|47805|193.110.157.68|25) (mx.nohats.ca ESMTP Postfix)
>
   Let freedom ring :-P

   Comments on the draft, make them official I guess. What I wrote was:

-------------------------------------------------------------

   Hi Paul,

   I kind of ran through my comments pretty quickly so let me repeat
them here so they don't get lost:

   - like the TLS 1.0 to historic, I think this draft should be BCP
   - make the title ikev1-to-historic, get rid of cutesy name
   - remove all the subjective opinion in section 3-- all the "high
     chance" or "most likely" or "quite often" etc-- and just mention
     that anything IKEv1 can do IKEv2 can do better, and that the
     reasons to do IKEv1 in the past-- PQ and labeled IPsec-- are
     no longer legit due to the advancement of the relevant drafts
   - I don't think deprecating the registries is necessary if the
     RFC goes to historic, as you note, there's been no work on IKEv1
     for over a decade so leaving the registries alone will not be
     some backdoor way of sneaking in IKEv1 changes. Other orgs are
     using the repository so just deprecating is not right.
   - If you're gonna reject any DH groups then reject the weak ones,
     it doesn't make sense to do 1 and 22 and leave 2 and 5 (and 23
     and 24!) alone.

It didn't look like there was any opposition to adopting this so
just consider these as comments on the draft as adopted.

   thanks,

   Dan.

-- 
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius

---

From: Paul Wouters <[email-masked]>
Date: Mon, 8 Mar 2021 10:10:50 -0500 (EST)

>>     Diagnostic code: smtp;550 5.7.1 <[email-masked]>: Sender address
>>     rejected: Exercising my freedom to not hear you scream

I had put that in after a rather unpleasant email exchange and forgot
about it. I've removed it now.

>   - like the TLS 1.0 to historic, I think this draft should be BCP

Ben said this might not be the best example and was an excepion in the
process? I'm also not sure if a BCP can have IANA Considerations ?

>   - make the title ikev1-to-historic, get rid of cutesy name

That is really only in the draft name, not the title. The title is:

 	Deprecation of IKEv1 and obsoleted algorithms

I'm fine changing the draft name to draft-ipsecme-ikev1-algo-to-historic
and the title to "Moving IKEv1 and obsoleted algorithms to Historic"

>     no longer legit due to the advancement of the relevant drafts

It would be nice to keep some of the justifications in there.  I can
look at rephrasing it a bit.

>     using the repository so just deprecating is not right.

I thought it would just be a stronger signal to implementers, but if
there are practical concerns, like people still shoehorning things in
there then it can be removed from this document. As Tero said, those
registries cannot really be populated with new stuff without involving
the WG, so we can just count on our regular IKEv1 change pushbacks.

>     it doesn't make sense to do 1 and 22 and leave 2 and 5 (and 23

DH updates should be done in RFC 8247bis. This document only obsoleted
the algorithms that either had no specifiction to begin with, or have
been stuck in MAY because no one cares about them.

> just consider these as comments on the draft as adopted.

Will do, thanks!

Paul