Subject: [Ipsec] FW: I-D ACTION:draft-sheffer-ike-session-resumption-00.txt

From: "Yaron Sheffer" <[email-masked]>
Date: Tue, 23 Jan 2007 11:19:19 +0200

Hi,

I have just published this initial draft, together with Hannes and Tao. The
draft relates to the new work (and upcoming BOF) on IPsec failover. We would
appreciate your comments on the IPsec mailing list.

Thanks,

      Yaron

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] 
Sent: Monday, January 22, 2007 22:50
To: [email-masked]
Subject: I-D ACTION:draft-sheffer-ike-session-resumption-00.txt 

A New Internet-Draft is available from the on-line Internet-Drafts 

directories.

      Title       : Stateless Session Resumption for the IKE Protocol

      Author(s)   : Y. Sheffer, et al.

      Filename    : draft-sheffer-ike-session-resumption-00.txt

      Pages       : 17

      Date        : 2007-1-22

   The Internet Key Exchange version 2 (IKEv2) protocol is

   computationally intensive with respect to the number of round-trips

   required and cryptographic operations involved.  In particular the

   Extensible Authentication Protocol is used for authentication, which

   adds additional computational intensity.

   To re-establish security associations (SA) upon a failure recovery

   condition is time comsuming, especially when an IPsec peer, such as a

   VPN gateway, needs to re-establish a large number of SAs with various

   end points.  A high number of concurrent sessions might cause

   additional problems for an IPsec peer during SA restablishment.

   In many failure cases it would be useful to provide an efficient way

   to resume an interrupted IKE/IPsec session.  This document proposes

   an extension to IKEv2 that allows a client to re-establish an IKE SA

   with a gateway in a highly efficient manner, utilizing a previously

   establied IKE SA.

   A client can reconnect to a gateway from which it was disconnected,

   or alternatively migrate to another gateway that is associated with

   the previous one.  The proposed approach conveys IKEv2 state

   information, in the form of an encrypted ticket, to a VPN client that

   is later presented to the VPN gateway for re-authentication.  An

   encrypted ticket cannot be decrypted by a VPN client but allows a VPN

   gateway to restore state for faster session state setup.

A URL for this Internet-Draft is:

http://www.ietf.org/internet-drafts/draft-sheffer-ike-session-resumption-00.
txt

To remove yourself from the I-D Announcement list, send a message to 

[email-masked] with the word unsubscribe in the body of 

the message. 

You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce 

to change your subscription settings.

Internet-Drafts are also available by anonymous FTP. Login with the 

username "anonymous" and a password of your e-mail address. After 

logging in, type "cd internet-drafts" and then 

"get draft-sheffer-ike-session-resumption-00.txt".

A list of Internet-Drafts directories can be found in

http://www.ietf.org/shadow.html 

or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Internet-Drafts can also be obtained by e-mail.

Send a message to:

      [email-masked].

In the body type:

      "FILE /internet-drafts/draft-sheffer-ike-session-resumption-00.txt".

NOTE: The mail server at ietf.org can return the document in

      MIME-encoded form by using the "mpack" utility.  To use this

      feature, insert the command "ENCODING mime" before the "FILE"

      command.  To decode the response(s), you will need "munpack" or

      a MIME-compliant mail reader.  Different MIME-compliant mail readers

      exhibit different behavior, especially when dealing with

      "multipart" MIME messages (i.e. documents which have been split

      up into multiple messages), so check your local documentation on

      how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader

implementation to automatically retrieve the ASCII version of the

Internet-Draft.

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec