Subject: RE: [Ipsec] Reauthentication in IKEv2

From: [email-masked]
Date: Thu, 28 Oct 2004 17:47:13 +0300

Yoav Nir writes:
> 
> I think that other than my draft there are several other 
> ideas floating around like OCSP extensions, your own mobility 
> and multi-homing, IKE over TCP, IKE over SCTP, hash-and-URL 
> for PUT certificates, etc.
> 
> Maybe instead of many small drafts, we need to join all these 
> into one big "Optional Extensions for IKEv2" document, which 
> will list all of these.

No, I don't think bundling them is a good idea. 

If we have a good solution for a relevant problem (like your draft), 
there's rough consensus on that, and there are no important 
dependencies to/from other work, let's publish it. If we wait 
for everything else IKEv2-related to be finished, it'll take
several years before we have any RFCs.

Best regards,
Pasi

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Yoav Nir <[email-masked]>
Date: Thu, 28 Oct 2004 18:09:09 +0200

OK.  I'm all for publishing this, but I'm not sure that there really is 
a rough consensus.  I will publish another draft when the IKEv2 RFC 
comes out, but I'm not sure how to proceed from there.

---

From: Jari Arkko <[email-masked]>
Date: Thu, 28 Oct 2004 20:15:01 +0300

> several years before we have any RFCs.

I agree with this. Small, well-focused extensions is the
way to go.

And I'd add your certificate-less server authentication
with mutually authenticating EAP methods draft
(draft-eronen-ipsec-ikev2-eap-auth-01.txt) to the list
of good ideas to take forward. Mobility and multihoming
is already being dealt with in a separate WG. If your
draft and Yoav's draft could go forward somewhere then
my highest priority items would be done.

--Jari