Subject: [Mip6] Removal of name selector from RFC 2401

From: "Barany, Pete" <[email-masked]>
Date: Thu, 23 Oct 2003 10:08:34 -0700

Hi,

The IETF IPsec WG is discussing RFC 2401bis and is considering removing
the "name" selector from Section 4.4.2 of RFC 2401. They are asking if
anyone is using it? Since the Mobile IPv6 specification has mention of
using the ID_USER_FQDN (e.g., [email-masked]) or ID_FQDN (e.g.,
foobar.com) Identification Type value in the ISAKMP Identification
payload for Phase I aggressive mode (pre-shared secret), I suggest that
this is not a good idea and that perhaps the Chairs should communicate
this to the Chairs of the IETF IPsec WG. Thanks.

See the INSERTed e-mail below.

Regards,

Pete

--> INSERT e-mail
-------- Original Message --------
Subject: 2401bis Issue # 89 -- Remove the selector "name"
Date: Wed, 22 Oct 2003 20:31:23 -0700
From: Karen Seo <[email-masked]>
To: ipsec mailingList <[email-masked]>
CC: <[email-masked]>, <[email-masked]>, "Angelos D. Keromytis" 
<[email-masked]>, <[email-masked]>, <[email-masked]>

Folks,

Here's a description and proposed approach for:

IPsec Issue #:  89

Title:          Remove the selector "name"

Description
===========
In the interest of simplifying things, we propose to remove the selector
"Name".  Is anyone using this selector?

Proposed approach
=================
Remove text such as the following:

   [From Section 4.4.2 "Selectors"]

   "- Name: There are 2 cases (Note that these name forms are
      supported in the IPsec DOI.)
          1. User ID
              a. a fully qualified user name string (DNS),
                 e.g., [email-masked]
              b. X.500 distinguished name, e.g., C = US,
                 SP = MA,  O = GTE Internetworking, CN =
                 Stephen T. Kent.
          2. System name (host, security gateway, etc.)
              a. a fully qualified DNS name, e.g.,
                 foo.bar.com
              b. X.500 distinguished name
              c. X.500 general name

      NOTE: One of the possible values of this selector is
            "OPAQUE".

      [REQUIRED for the following cases.  Note that support
      for name forms other than addresses is not required for
      manually keyed SAs.
          o User ID
              - native host implementations
              - BITW and BITS implementations acting as HOSTS
                with only one user
              - security gateway implementations for INBOUND
                processing.
          o System names -- all implementations]"

Thank you,
Karen

_______________________________________________
Mip6 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mip6

---

From: Vijay Devarapalli <[email-masked]>
Date: Thu, 23 Oct 2003 11:44:05 -0700

isnt the proposal in the IPsec WG just to remove 'Name' from
IPsec selectors? not the ability to use "name" in IKE phase1.

Vijay