Subject: RE: Resolving Russ Housley's DISCUSSes on Node Requirements, part 2

From: [email-masked]
Date: Fri, 13 Aug 2004 06:08:21 +0300

Pekka,

> I don't know how intentional Russ's wording is, but if it is, this 
> certainly doesn't address it.
> 
> Russ says, "IKE should be a SHOULD".
> 
> You're written this as, "Key management is a SHOULD.  There are a
> number of key management techniques, including (but not limited to)  
> IKE.  Even TLS includes key management."
> 
> The reader of the spec could implement kerberos which would leave him 
> w/o automatic key management for IPsec.  The reader might also read 
> this so that just implementing TLS would be enough, when it clearly 
> isn't.
> 
> Why don't you just specify either IKEv1 or IKEv2 as a SHOULD, and put 
> a MAY or some other mention to the rest?

The problem is, how to pick between IKEv1 or IKEv2?  There is no guidence 
anywhere on this. 

However, discussing this point with Russ, his intention was more about 
Key Management, not specifically IKEv1 or IKEv2, hence my text.

My feeling is that one size fits all approach will not be sufficient
for all IPv6 deployments.

John

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: Pekka Savola <[email-masked]>
Date: Fri, 13 Aug 2004 09:07:34 +0300 (EEST)

> The problem is, how to pick between IKEv1 or IKEv2?  There is no guidence 

True, that could cause an interoperability issue.  But this is what
the security ADs should be giving guidance on :).

> Key Management, not specifically IKEv1 or IKEv2, hence my text.

What was the context of that discussion?  Was it key management for 
*IPsec* or key management in general.

If the former, I don't think the current text captures this clearly, 
as it mentions stuff like Kerberos, TLS and S/MIME.  If in general, 
then it's probably fine.

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings

---

From: Brian E Carpenter <[email-masked]>
Date: Fri, 13 Aug 2004 09:40:39 +0200

> as it mentions stuff like Kerberos, TLS and S/MIME.  If in general, 

I would strongly advise not making this document logically dependent
on the IETF giving unambiguous guidance on key management in general
or on IKE versions in particular. If we did so, we'd never get the
thing published. So IMHO we have no alternative to the "general"
context.

     Brian

---

From: Jari Arkko <[email-masked]>
Date: Fri, 13 Aug 2004 14:35:26 +0300

> thing published. So IMHO we have no alternative to the "general"

I agree. (Particularly without an RFC from the IPsec WG mandating
specific IKE versions or other detailed guidance that we could
rely on. The rest of this document is primarily based on what
other already existing RFCs say.)

--Jari