Subject: [storm] Two IPsec items - conclusion

From: "Black, David" <[email-masked]>
Date: Thu, 7 Nov 2013 14:06:10 -0500

Having seen  no comments on these two IPsec items (see below), absence of
comments is being taken as absence of objections, so the rough consensus
of the storm WG is that these changes are ok.

The revised draft will proceed toward RFC publication with these changes,
which are in the current -04 version:

	http://datatracker.ietf.org/doc/draft-ietf-storm-ipsec-ips-update/

After the last Discuss on this draft is cleared (should happen soon - the
Security ADs are kind of busy at the moment with all the attention being 
paid to pervasive passive monitoring], I will need to go write a couple
of RFC Editor notes to make the corresponding updates to the Consolidated
iSCSI draft (in my "copious spare time" ;-) ).  Those notes will get posted
to the list when they're ready.

> -- Two IPsec items --
> 
> Two technical changes were made to the IPsec update draft, and these will also
> need to be made to the consolidated iSCSI draft, as they affect the IPsec
> security considerations text there:
> 
> (A) OCSP is now allowed for checking certificates in addition to use of CRLs.
> 
> (B) Extended sequence numbers (ESNs) are now required for ESPv2 (IPsec v2 -
> 	RFC 2406) in addition to ESPv3 (IPsec v3 - RFC 4303).
> 
> The first change to allow OCSP, is a straightforward update to the current
> state of PKI certificate technology and usage.
> 
> The second change was the original intention for iSCSI use of IPsec (which is
> where all of this started) and got dropped when yours truly overlooked the
> existence of RFC 4304, which defines IKEv1 support for negotiating ESN usage.
> 
> One of the security ADs pointed out the existence of RFC 4304 and suggested
> this change, which makes a lot of sense, IMHO.  I believe ESN support to be
> widely available in IPsec v2 implementations.
> 
> If anyone cares about either of these, please comment - absence of comment
> will be taken as absence of objection.

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------