Subject: [Ipsec] Proposal and Transform Payloads

From: Case Richard A <[email-masked]>
Date: Fri, 15 Oct 2004 12:43:50 +0100

I am looking for clarification of RFC 2408 - I hope you can help!

1.	It is implied but nowhere stated that the Proposal and Transform
numbers must start at one (and not zero) and monotonically increase. Is this
the case?
2.	Does the order of preference decrease with increasing
Proposal/Transform numbers? i.e. 1 is most preferred, 2 is next most
preferred, etc...
3.	Can you include the same Data Attribute Type multiple times in the
SA Attribute field of a Transform Payload, or do different options need to
be included in separate Transform Payloads? E.g. In the Path 2, Main Mode,
Phase I exchange can I include two data attributes of type 3 (authentication
method - let's say for argument 2-DSS & 3-RSA signatures) in the same
Transform Payload?

Many thanks,

Richard

Richard Case 
Communication Engineer 

The Information contained in this E-Mail and any subsequent correspondence
is private and is intended solely for the intended recipient(s).
For those other than the recipient any disclosure, copying, distribution,
or any action taken or omitted to be taken in reliance on such information
is prohibited and may be unlawful.

Emails and other electronic communication with QinetiQ may be monitored.
Calls to QinetiQ may be recorded for quality control,
regulatory and monitoring purposes.
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: Joern Sierwald <[email-masked]>
Date: Fri, 15 Oct 2004 22:15:08 +0200

At 12:43 15.10.2004 +0100, Case Richard A wrote:

>    * It is implied but nowhere stated that the Proposal and Transform 
> numbers must start at one (and not zero) and monotonically increase. Is 
> this the case?

No. You can number them "3, 8, 32000" if you like. And you must be able to
accept such a list as valid input. There is a gentlemen's agreement
however, that states that you really should use 1,2,3,4...

>    * Does the order of preference decrease with increasing 
No, the order does not mean anything. While there are implementation who 
treat the list like that,
this is not a universally valid logic

>    * Can you include the same Data Attribute Type multiple times in the 
> SA Attribute field of a Transform Payload, or do different options need 
> to be included in separate Transform Payloads? E.g. In the Path 2, Main 
> Mode, Phase I exchange can I include two data attributes of type 3 
> (authentication method - let's say for argument 2-DSS & 3-RSA signatures) 
> in the same Transform Payload?

no, yes. no.

>Communication Engineer

Cheers, Jörn

---

From: Case Richard A <[email-masked]>
Date: Tue, 19 Oct 2004 16:19:56 +0100

Thanks to Jörn for his comments. I've now read the dictionary definition of
"monotonically" and the RFC makes a bit more sense.

>this is not a universally valid logic

If this is the case, are there implementations that ignore RFC 2408, section
4.2 ("The multiple transforms MUST be presented with monotonically
increasing numbers in the initiator's preference order.") ?

In which case how does the responder know in which order to process the
transforms?
Presumably by making a note of all Transforms, discarding incompatible
options and selecting from the remaining Transforms in its own preference
order?

Thanks again,
Richard

******************************************************

no, yes. no.

Cheers, Jörn