Subject: Moving forward on RFC 2401-bis

From: "Theodore Ts'o" <[email-masked]>
Date: Tue, 12 Aug 2003 12:25:11 -0400

Hi Steve, Karen.

We'd like to thank you for your excellent work in preparing the list of
issues and proposed changes/updates to RFC 2401.  Hopefully the members
of the IPSEC working group have had time to read over these lists we've
had a week or two of unstructured discussion over the changes to the
IPSEC processing model.

However, it is now time that we go through each of the changes in a
slightly more structured format.  To that end, Angelos has taken your
initial list of proposed changes and put them into the Roundup issues
tracker:

		https://roundup.machshav.com/ipsec

We would appreciate it if you could look over the list of changes let us
know if they are complete.  Then, if you could prepare a paragraph or
two for each proposed change, so the working group can consider each
change one at a time.  We would like to quickly, but explicitly have the
working group approve each change to RFC 2401, one at a time.

As a suggestion, we believe that issues #48 and #47 which is related to
the addition/changes of traffic selectors in IKEv2, be worked on first,
since they affect the IKEv2 document which is being finalized.  (As a
reminder, we wll not add traffic selectors for ToS in IKEv2 --- see
issue #16 --- unless we come to consensus that they should be added in
the architecture document.  If IKEv2 is published before we come to
consensus on issue #48, and issue #48 is adopted, this can always be
fixed by a supplemental RFC which documents the new TOS traffic
selector.  But this is a reason why we suggest that issue #48 be tackled
first.)

If you could post an short e-mail summarizing the costs and benefits of
adopting the TOS Traffic Selectors to the ipsec mailing list at your
earliest convenient to start discussion on that change, we would greatly
appreciate it.  Hopefully we will be able to come to consensus on all of
the changes to RFC 2401 with dispatch.

					- Ted and Barbara

---

From: Karen Seo <[email-masked]>
Date: Fri, 22 Aug 2003 18:57:23 -0400

Folks,

Just an update... We've reviewed the 9 items on the IPsec tracking 
list for 2401:

1. We believe the following 5 items have been resolved.  At the 
beginning of next week, we will send out individual writeups for the 
following items:
	47	All selectors can be a list of ranges, per IKEv2 spec
	48 	Add ToS traffic selector option
	49	Red-side fragmentation option
	50	Tunnel vs transport mode
	57	ECN support

2. Four of the items are inter-related and should be addressed 
together as part of the new IPsec processing model, which is still 
being discussed.  Later next week, we will send out a revised version 
of the write up on the processing model with updates reflecting 
feedback/conclusions to date.  This will cover the following items:
	40 	Interface SPD selector vs per-interface SPD
	44 	Forwarding table lookup to select virtual interface ID
	45 	Use of cache with de-correlated SPD
	46	No need for iterated processing

3. In addition to the items in the tracking system, there are a 
number of other issues that have come up during the past months. 
Over the next couple of weeks, we will be sending out descriptions of 
these issues for group review/discussion.

Have a good weekend!
Karen

---

From: Karen Seo <[email-masked]>
Date: Sat, 23 Aug 2003 23:56:21 -0400

Angelos,

>Karen, great. One nit: none of the items are "resolved" as such. They need to
>be discussed on the list first. (That's because, unlike the issues in the IKE
>draft, these are architectural changes that have not been previously
>discussed.)

	Sorry for not being clear.  What I was trying to say is
	that we "believe" they've been resolved (because they've
	been discussed on the list and a consensus appeared to have
	been reached) and that we'll circulate descriptions of each
	issue.  I was assuming that when these were distributed to
	the list, folks would get a chance to look at the writeups
	and assess them, presumably with the opportunity to change
	things etc.

Karen

>Cheers,
>-Angelos
>
>In message <p05200f0dbb6c4b053bc0@[128.89.89.115]>, Karen Seo writes:
>>Folks,
>>

---

From: "Angelos D. Keromytis" <[email-masked]>
Date: Sat, 23 Aug 2003 13:25:34 -0400

---

From: "Angelos D. Keromytis" <[email-masked]>
Date: Sun, 24 Aug 2003 12:04:17 -0400

Great, we're in agreement.
-Angelos