Subject: Re: [Ipsec] FW: Remaining issues for IKEv2

From: Stephen Kent <[email-masked]>
Date: Mon, 10 May 2004 22:08:20 -0400

Charlie,

I do not agree with your attempt to provide a concise 
characterization of the fragment handling topic. Its a complex topic, 
as illustrated by the length of my memo, and not easily distilled 
further.

I believe the WG has come to a decision re fragment handling, as 
reflected in message traffic following my memo on the topic. The 
decision calls for IKEv2 to support negotiation of OPAQUE as a value 
for traffic selectors, at least for port fields. Let's not translate 
this into a negotiation of fragment handling policy.

Steve

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Mon, 10 May 2004 20:05:04 -0700

At 10:08 PM -0400 5/10/04, Stephen Kent wrote:
>reflected in message traffic following my memo on the topic.

Re-reading the thread that Ted started called "CONSENSUS TEST: 
Fragmentation handling", it is unclear how one can claim consensus. 
There were many suggestions for re-wordings, different suggestions 
for the MUST/SHOULD/MAY level, and different suggestions for the 
meaning of the values proposed.

--Paul Hoffman, Director
--VPN Consortium

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Mon, 10 May 2004 20:05:04 -0700

--Paul Hoffman, Director
--VPN Consortium

---

From: Stephen Kent <[email-masked]>
Date: Tue, 11 May 2004 12:23:17 -0400

>meaning of the values proposed.

I made suggested changes and reached accord with the folks who 
actively participated and offered such suggestions on the list: 
Tero, Markku, Michael, Paul Konig, and Mark Duffy. My acceptance of 
the changes is also documented on the list. The resulting text is in 
the latest version of 2401bis that was posted a week ago. As I said, 
this appears to me to have been resolved, in that the folks who cared 
enough to participate in the discussion did not raise any objections 
after all of the changes were made.

But, I did misspeak yesterday in my hasty reply to Charlie.  At 
Tero's suggestion, the text dealing with fragment handling does refer 
to a NOTIFY for IKEv2 in support of one of the options, in addition 
to the use of OPAQUE selectors.

Steve

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Tue, 11 May 2004 09:44:42 -0700

At 12:23 PM -0400 5/11/04, Stephen Kent wrote:
>the changes is also documented on the list.

... but the final wording is not.

>  The resulting text is in the latest version of 2401bis that was 
>posted a week ago.

Yes, but not the proposed wording for IKEv2. Having specific, final 
wording for Charlie on the list would make it much easier than asking 
him to synthesize it from the thread and from your corrections. It 
would also give the above people a chance to see if they agree with 
your assessment of consensus on the IKEv2 part of the discussion.

>Tero's suggestion, the text dealing with fragment handling does 
>refer to a NOTIFY for IKEv2 in support of one of the options, in 
>addition to the use of OPAQUE selectors.

...thereby making it even more clear that specific wording on the 
list is needed before you assert to Charlie that he should make 
changes to the IKEv2 document.

--Paul Hoffman, Director
--VPN Consortium

---

From: Stephen Kent <[email-masked]>
Date: Tue, 11 May 2004 12:23:17 -0400

Steve

---

From: Paul Hoffman / VPNC <[email-masked]>
Date: Tue, 11 May 2004 09:44:42 -0700

--Paul Hoffman, Director
--VPN Consortium

---

From: [email-masked]
Date: Tue, 11 May 2004 20:03:10 -0400

Folks,

Just to provide a pointer... Section 7 of the current draft of 
2401bis contains the 3 options that Steve posted to the list for 
handling outgoing fragments on the protected side.  The text reflects 
changes as best I could figure from the list discussion. Since the 
community hasn't yet decided whether options 2 and 3 should be MAY or 
SHOULD, the draft says "MAY/SHOULD" for each.
	- Option 1 doesn't require any changes to IKEv2 and seems to
	  be accepted by the community.
	- Option 2 requires support for OPAQUE, so IKEv2 would need
	  to support this value.
	- For the Option 3 (stateful fragment checking), we put in the
	  suggestion from Tero (a new notify message).  This would
	  need IKEv2 support.

Karen

---

From: [email-masked]
Date: Tue, 11 May 2004 20:03:10 -0400

Folks,

Karen