Subject: [IPsec] Éric Vyncke's No Objection on draft-ietf-ipsecme-ikev2-intermediate-09: (with COMMENT)

From: Éric Vyncke via Datatracker <[email-masked]>
Date: Tue, 01 Mar 2022 22:37:33 -0800

Éric Vyncke has entered the following ballot position for
draft-ietf-ipsecme-ikev2-intermediate-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ikev2-intermediate/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you for the work put into this document.

Please find below some non-blocking COMMENT points (but replies would be
appreciated even if only for my own education).

Special thanks to Yoav Nir for the shepherd's write-up including the section
about the WG consensus.

I hope that this helps to improve the document,

Regards,

-éric

## Abstract

The abstract would benefit by adding a few use cases / applicability statement
(per the shepherd's write-up and introduction, i.e., a hint for PQ crypto).

## Section 1

s/If size of a message is large enough, IP fragmentation takes place/If size of
a message is larger than the MTU, IP fragmentation takes place/

RFC 7383 is dated 2014, is it still applicable in 2022 ?

---

From: Valery Smyslov <[email-masked]>
Date: Wed, 2 Mar 2022 10:09:41 +0300

Hi Éric,

thank you for your comments.

> https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ikev2-intermediate/

I updated the abstract as follows:

   This document defines a new exchange, called Intermediate Exchange,
   for the Internet Key Exchange protocol Version 2 (IKEv2).  This
   exchange can be used for transferring large amounts of data in the
   process of IKEv2 Security Association (SA) establishment.  An example
   of the need to do this is using Quantum Computer resistant key
   exchange methods for IKE SA establishment.  Introducing the
   Intermediate Exchange allows re-using the existing IKE fragmentation
   mechanism, that helps to avoid IP fragmentation of large IKE
   messages, but cannot be used in the initial IKEv2 exchange.

Is it OK?

> a message is larger than the MTU, IP fragmentation takes place/

I have no problem with this clarification, but I suggest s/MTU/PMTU
in the new text, since IP fragmentation for IPv4 can also take place
on the intermediate routers. So, if you don't mind, I'll change the text to:

"If the size of a message is larger than the PMTU, ..."

> RFC 7383 is dated 2014, is it still applicable in 2022 ?

Yes. The problems with correct handling of IP fragments in SOHO devices
still persist, as far as I know, so RFC 7383 is still applicable. 
Most (if not all) IPsec vendors support it.

Thank you!

Regards,
Valery.

---

From: "Eric Vyncke (evyncke)" <[email-masked]>
Date: Wed, 2 Mar 2022 07:19:52 +0000

Valery

Thank you for such a prompt reply.

I agree with all your comments and suggestions for new text.

Regards

-éric

-----Original Message-----
From: Valery Smyslov <[email-masked]>
Date: Wednesday, 2 March 2022 at 08:10
To: Eric Vyncke <[email-masked]>, 'The IESG' <[email-masked]>
Cc: "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: RE: Éric Vyncke's No Objection on draft-ietf-ipsecme-ikev2-intermediate-09: (with COMMENT)

    Hi Éric,

    Is it OK?

    Thank you!

    Regards,
    Valery.